7294e29167cf8ea40ec76fd33a174a43_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

7294e29167cf8ea40ec76fd33a174a43_JaffaCakes118
Size

18.4MB
MD5

7294e29167cf8ea40ec76fd33a174a43
SHA1

69a651688b79a79edee75f6bec495372d0896f49
SHA256

68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f
SHA512

6968f2fae0a6a4117f7b38be499ce4666da39c1c914a846679418e1d25817fe6d869a404dc9934cbee3f0f831ae8c15298de77630089b69bb5d1920c6fb49241
SSDEEP

393216:mJTKHH8wh67fJQ61DjbR//rXefAzPnqQtuCUoy+0teV0C2bqw43:vc1C61NHUATn50jdUV0CQF4

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/GetVersion.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/GetVersion.dll	upx

Unsigned PE 61 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$COMMONFILES/nProtect Shared/Engine/tyavexcept.bin
unpack001/$PLUGINSDIR/GetVersion.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/npcf_win_32u.dll
unpack001/$SYSDIR/TKFsAv.sys
unpack001/$SYSDIR/TKFsAv64.sys
unpack001/$SYSDIR/TKIdsVt.sys
unpack001/$SYSDIR/TKIdsVt64.sys
unpack001/$SYSDIR/TKPcFtCb64.sys
unpack001/$SYSDIR/TKPcFtHk.sys
unpack001/$SYSDIR/TKRgAc2k.sys
unpack001/$SYSDIR/TKRgAc2k64.sys
unpack001/$SYSDIR/TKRgFtXp.sys
unpack001/$SYSDIR/TKRgFtXp64.sys
unpack001/$SYSDIR/noska.sys
unpack001/$SYSDIR/noskp.sys
unpack001/$SYSDIR/noskp64.sys
unpack001/$SYSDIR/nosku.sys
unpack001/$SYSDIR/nosku64.sys
unpack001/$SYSDIR/tkfwvt.sys
unpack001/$SYSDIR/tkfwvt64.sys
unpack001/7z.dll
unpack001/cert/certmgr.exe
unpack001/cert/freebl3.dll
unpack001/cert/libnspr4.dll
unpack001/cert/libplc4.dll
unpack001/cert/libplds4.dll
unpack001/cert/nss3.dll
unpack001/cert/nssckbi.dll
unpack001/cert/nssdbm3.dll
unpack001/cert/nssutil3.dll
unpack001/cert/smime3.dll
unpack001/cert/softokn3.dll
unpack001/cert/sqlite3.dll
unpack001/cert/ssl3.dll
unpack001/coredll/network/x64/TKIdsVt64.sys
unpack001/coredll/network/x64/tkfwvt64.sys
unpack001/coredll/network/x86/TKIdsVt.sys
unpack001/coredll/network/x86/tkfwvt.sys
unpack001/coredll/protect/x64/TKFsAv64.sys
unpack001/coredll/protect/x64/TKPcFtCb64.sys
unpack001/coredll/protect/x64/TKRgAc2k64.sys
unpack001/coredll/protect/x64/TKRgFtXp64.sys
unpack001/coredll/protect/x86/TKFsAv.sys
unpack001/coredll/protect/x86/TKPcFtHk.sys
unpack001/coredll/protect/x86/TKRgAc2k.sys
unpack001/coredll/protect/x86/TKRgFtXp.sys
unpack001/coredll/rtd/tyavexcept.bin
unpack001/npcf_win_32u.dll
unpack001/npk/noska.sys
unpack001/npk/noskp.sys
unpack001/npk/noskp64.sys
unpack001/npk/nosku.sys
unpack001/npk/nosku64.sys
unpack001/npk/npcf_win_32u.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsDialogs.dll

Files

7294e29167cf8ea40ec76fd33a174a43_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

89:26:82:f7:c6:e3:56:c5:c7:42:aa:5d:d0:9c:ec:a6:55:3f:05:7f:75:cb:0e:5e:4e:51:d2:a2:bd:6f:a7:ab
Signer

Actual PE Digest

89:26:82:f7:c6:e3:56:c5:c7:42:aa:5d:d0:9c:ec:a6:55:3f:05:7f:75:cb:0e:5e:4e:51:d2:a2:bd:6f:a7:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/BWT.dll
.dll windows:4 windows x86 arch:x86

b16b05115529f7bbc3cb142f11ec7320

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b1:1c:21:24:c1:96:72:1a:17:b7:c6:69:53:68:94:d7:3b:fc:3e:7e:89:34:8c:0b:a5:11:90:b2:60:9b:4f:67
Signer

Actual PE Digest

b1:1c:21:24:c1:96:72:1a:17:b7:c6:69:53:68:94:d7:3b:fc:3e:7e:89:34:8c:0b:a5:11:90:b2:60:9b:4f:67

Digest Algorithm

sha256

PE Digest Matches

true

2a:af:32:35:28:48:5b:ef:21:09:3e:21:b1:8e:97:42:a5:0a:0c:1d
Signer

Actual PE Digest

2a:af:32:35:28:48:5b:ef:21:09:3e:21:b1:8e:97:42:a5:0a:0c:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\bwt\BWT.pdb

Imports

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect

crypt32

CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertOpenSystemStoreW

rpcrt4

UuidCreate

kernel32

WriteConsoleA
GetConsoleOutputCP
SetStdHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
OutputDebugStringW
LeaveCriticalSection
GetLastError
CreateThread
WaitForSingleObject
CloseHandle
lstrlenA
MultiByteToWideChar
CreateEventW
GetProcAddress
GetModuleHandleW
Sleep
lstrlenW
WideCharToMultiByte
SetEvent
FindResourceW
WriteConsoleW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateFileW
CreateFileMappingW
MapViewOfFile
GetFileSize
UnmapViewOfFile
GetWindowsDirectoryW
GetExitCodeThread
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
GetConsoleMode
ReadFile
CreateFileA
FlushFileBuffers
OutputDebugStringA
InterlockedIncrement
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
VirtualFree
VirtualAlloc
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LoadLibraryA
SetFilePointer
GetConsoleCP

user32

UnregisterClassA

advapi32

RevertToSelf
ImpersonateLoggedOnUser
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

BWTControl

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/BWTTrustList.dat
$COMMONFILES/nProtect Shared/Engine/BwtTrust.dll
.dll windows:4 windows x86 arch:x86

03a1fe3fde0b98269544b8bec2d124a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5
Signer

Actual PE Digest

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5

Digest Algorithm

sha256

PE Digest Matches

true

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de
Signer

Actual PE Digest

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\Release\BwtTrust.pdb

Imports

psapi

GetMappedFileNameW

kernel32

CreateFileMappingW
GetCurrentProcess
QueryDosDeviceW
GetLogicalDriveStringsW
SetEndOfFile
SetFilePointer
GetFileSize
WriteFile
GetDriveTypeW
GetLastError
MapViewOfFile
OutputDebugStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
SetEvent
FindClose
UnmapViewOfFile
SetFileAttributesW
DeleteFileW
GetFileAttributesW
CloseHandle
CreateFileW
CompareStringW
OpenFileMappingW
TlsSetValue
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
SetEnvironmentVariableA
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
VirtualAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
FlushFileBuffers
CompareStringA

advapi32

RegQueryValueExW
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
RegOpenKeyExW

Exports

Exports

RequestService

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/NpBWT.dll
.dll windows:5 windows x86 arch:x86

a60200e3067da2c9a407d52e73c19fac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44
Signer

Actual PE Digest

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44

Digest Algorithm

sha256

PE Digest Matches

true

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a
Signer

Actual PE Digest

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpBWTStatic\Win32\NpBWT.pdb

Imports

kernel32

GetSystemInfo
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
MapViewOfFile
UnmapViewOfFile
GetLastError
CreateFileMappingW
OpenFileMappingW
CloseHandle
VirtualFree
VirtualAlloc
FreeLibrary
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
SetLastError
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW

Exports

Exports

fnBWTControl

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/NpHttpsLib.dll
.dll windows:5 windows x86 arch:x86

a7df12cc332635377ea71a48f8b49a32

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:a6:12:0a:03:11:aa:86:29:0f:db:06:35:97:8d:21:ce:c3:b2:ad:3f:f5:83:58:1c:bc:80:4c:ca:9f:b6:32
Signer

Actual PE Digest

4a:a6:12:0a:03:11:aa:86:29:0f:db:06:35:97:8d:21:ce:c3:b2:ad:3f:f5:83:58:1c:bc:80:4c:ca:9f:b6:32

Digest Algorithm

sha256

PE Digest Matches

true

73:c7:b4:57:4d:7a:c4:3d:19:9b:3a:19:7e:0f:4f:3b:a3:f6:1c:73
Signer

Actual PE Digest

73:c7:b4:57:4d:7a:c4:3d:19:9b:3a:19:7e:0f:4f:3b:a3:f6:1c:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpHttpsLibStatic\Win32\NpHttpsLib.pdb

Imports

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW

ws2_32

gethostname
ioctlsocket
__WSAFDIsSet
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
shutdown
WSASetLastError
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
send
recv
WSAGetLastError
WSAStartup
WSACleanup
select

wldap32

ord26
ord30
ord32
ord35
ord79
ord50
ord33
ord301
ord27
ord41
ord46
ord60
ord143
ord211
ord22
ord200

kernel32

FileTimeToLocalFileTime
GetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeA
FindFirstFileExA
CreateFileA
ReadConsoleInputA
SetConsoleMode
FileTimeToSystemTime
GetProcessHeap
GetFileInformationByHandle
FlushConsoleInputBuffer
GetVersionExW
GlobalMemoryStatus
GetVersion
ExpandEnvironmentStringsA
LoadLibraryA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
SleepEx
SetEnvironmentVariableA
CompareStringW
FlushFileBuffers
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetLastError
CloseHandle
VirtualFree
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
SetEvent
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
CreateEventW
DeleteCriticalSection
GetSystemTime
CreateDirectoryW
FindClose
DeleteFileW
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
SetLastError
LCMapStringW
GetStringTypeW
GetTimeZoneInformation
RaiseException
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
RtlUnwind
GetConsoleCP
GetConsoleMode
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
GetDriveTypeW

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
fnCloseFtp
fnCloseHttps
fnCreateDirectoryFtp
fnDeleteDirectoryFtp
fnDeleteFileFtp
fnGetBuffer
fnGetBufferData
fnGetBufferDataSize
fnGetCurlCode
fnGetFileFtp
fnGetFileListFtp
fnOpenFtp
fnOpenHttps
fnPerform
fnPutFileFtp
fnPutFileRenameFtp
fnSetConnectionClose
fnSetHttpDownloadFile
fnSetHttpHeader
fnSetHttpTypeGet
fnSetHttpTypePost
fnSetProxy
fnSetSFTPKeyFile
fnSetSSLVerifyPear
fnSetTimeoutMilliSec
fnSetUserAgent
libssh2_banner_set
libssh2_base64_decode
libssh2_channel_close
libssh2_channel_direct_tcpip_ex
libssh2_channel_eof
libssh2_channel_flush_ex
libssh2_channel_forward_accept
libssh2_channel_forward_cancel
libssh2_channel_forward_listen_ex
libssh2_channel_free
libssh2_channel_get_exit_signal
libssh2_channel_get_exit_status
libssh2_channel_handle_extended_data
libssh2_channel_handle_extended_data2
libssh2_channel_open_ex
libssh2_channel_process_startup
libssh2_channel_read_ex
libssh2_channel_receive_window_adjust
libssh2_channel_receive_window_adjust2
libssh2_channel_request_pty_ex
libssh2_channel_request_pty_size_ex
libssh2_channel_send_eof
libssh2_channel_set_blocking
libssh2_channel_setenv_ex
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_window_read_ex
libssh2_channel_window_write_ex
libssh2_channel_write_ex
libssh2_channel_x11_req_ex
libssh2_exit
libssh2_free
libssh2_hostkey_hash
libssh2_init
libssh2_keepalive_config
libssh2_keepalive_send
libssh2_knownhost_add
libssh2_knownhost_addc
libssh2_knownhost_check
libssh2_knownhost_checkp
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_readline
libssh2_knownhost_writefile
libssh2_knownhost_writeline
libssh2_poll
libssh2_poll_channel_read
libssh2_scp_recv
libssh2_scp_send64
libssh2_scp_send_ex
libssh2_session_abstract
libssh2_session_banner_get
libssh2_session_banner_set
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_get_blocking
libssh2_session_get_timeout
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_methods
libssh2_session_set_blocking
libssh2_session_set_timeout
libssh2_session_startup
libssh2_session_supported_algs
libssh2_sftp_close_handle
libssh2_sftp_fstat_ex
libssh2_sftp_fstatvfs
libssh2_sftp_get_channel
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_tell
libssh2_sftp_tell64
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_trace
libssh2_trace_sethandler
libssh2_userauth_authenticated
libssh2_userauth_hostbased_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey
libssh2_userauth_publickey_fromfile_ex
ssl2_ciphers
ssl3_ciphers

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/TYAVPU_000.bin
$COMMONFILES/nProtect Shared/Engine/TYAVP_001.bin
$COMMONFILES/nProtect Shared/Engine/TYAVSU_000.bin
$COMMONFILES/nProtect Shared/Engine/TeCtrl.dll
.dll windows:4 windows x86 arch:x86

f2f04e8d6a48038cbe0d8f6678090077

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c5:a2:4b:91:a7:11:0b:3b:24:00:de:50:f8:15:82:d7:eb:ae:68:9d:2d:30:64:e2:d2:3f:4f:12:81:ac:31:fe
Signer

Actual PE Digest

c5:a2:4b:91:a7:11:0b:3b:24:00:de:50:f8:15:82:d7:eb:ae:68:9d:2d:30:64:e2:d2:3f:4f:12:81:ac:31:fe

Digest Algorithm

sha256

PE Digest Matches

true

05:03:fb:75:b2:ff:56:bc:87:b9:e3:9c:43:1d:2b:a1:49:24:02:8c
Signer

Actual PE Digest

05:03:fb:75:b2:ff:56:bc:87:b9:e3:9c:43:1d:2b:a1:49:24:02:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrl.pdb

Imports

kernel32

WaitForSingleObject
CreateRemoteThread
GetModuleHandleA
OpenProcess
UnmapViewOfFile
QueryDosDeviceA
GetLogicalDriveStringsA
MapViewOfFile
CreateFileMappingA
TerminateThread
CreateThread
DuplicateHandle
LocalFree
LocalAlloc
HeapFree
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
SetEvent
InterlockedExchange
GetVersion
CreateMutexA
OpenMutexA
GlobalMemoryStatus
RemoveDirectoryA
FindClose
FindNextFileA
SetFileAttributesA
FindFirstFileA
CreateDirectoryA
GetTempPathA
Sleep
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
GetTickCount
lstrlenW
CompareStringA
GetCurrentProcess
lstrcmpiA
lstrcmpiW
lstrlenA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
OutputDebugStringA
OutputDebugStringW
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
ResetEvent
ExpandEnvironmentStringsA
GetWindowsDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetThreadLocale
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetVersionExA
GetFileAttributesA
DeleteFileA
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetLastError
GlobalAlloc
SetLastError
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GlobalFree
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
CreateFileA
GetFileSize
ReadFile
CompareStringW
RaiseException
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
ExitProcess
WriteFile
GetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA

user32

CharLowerA
CharUpperW
UnregisterClassA
CharUpperA
CharLowerW
wsprintfA

advapi32

RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
AdjustTokenPrivileges

shell32

SHGetFolderPathA

shlwapi

PathFindExtensionA
PathIsRelativeA

imagehlp

MapAndLoad
UnMapAndLoad

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertGetNameStringA

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeEnableBWT
NpeEnableBWTEx
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 340KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/TeCtrlu.dll
.dll windows:4 windows x86 arch:x86

5fc585f53e552845cbfa41093fe3bbe6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

36:83:48:55:b0:1a:b5:ca:75:00:11:94:88:d1:14:0d:28:17:0d:3f:44:62:2b:45:0a:35:9c:f4:fc:ec:88:e7
Signer

Actual PE Digest

36:83:48:55:b0:1a:b5:ca:75:00:11:94:88:d1:14:0d:28:17:0d:3f:44:62:2b:45:0a:35:9c:f4:fc:ec:88:e7

Digest Algorithm

sha256

PE Digest Matches

true

f3:90:58:10:b9:47:13:51:3b:1a:30:db:71:35:f8:e0:49:1f:cc:a9
Signer

Actual PE Digest

f3:90:58:10:b9:47:13:51:3b:1a:30:db:71:35:f8:e0:49:1f:cc:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrlu.pdb

Imports

kernel32

GetCurrentProcess
UnmapViewOfFile
QueryDosDeviceW
GetLogicalDriveStringsW
MapViewOfFile
CreateFileMappingW
WaitForSingleObject
CreateRemoteThread
GetModuleHandleW
OpenProcess
TerminateThread
CreateThread
DuplicateHandle
lstrcpynW
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameW
CreateMutexW
OpenMutexW
DeleteCriticalSection
InitializeCriticalSection
GlobalMemoryStatus
CreateDirectoryW
RemoveDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetTempPathW
GetVersionExW
GetTickCount
Sleep
lstrlenW
OutputDebugStringW
ResetEvent
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
FindResourceExW
SizeofResource
LockResource
LoadResource
FindResourceW
ExitProcess
GetModuleFileNameA
lstrlenA
GetThreadLocale
SetEnvironmentVariableA
CompareStringW
CompareStringA
MultiByteToWideChar
GetFileAttributesW
DeleteFileW
GlobalAlloc
SetLastError
GlobalFree
CreateFileA
GetLastError
LoadLibraryW
CloseHandle
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InterlockedExchange
GetSystemDirectoryW
GetProcAddress
FreeLibrary
CreateFileW
GetFileSize
ReadFile
WideCharToMultiByte
CreateEventW
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
WriteFile
GetStdHandle
LCMapStringA
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler

user32

GetActiveWindow
UnregisterClassA
MessageBoxA
wsprintfW

advapi32

LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges

shell32

SHGetFolderPathW

shlwapi

PathIsRelativeW
PathFindExtensionW

imagehlp

MapAndLoad
UnMapAndLoad

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertGetNameStringW

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeEnableBWT
NpeEnableBWTEx
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 392KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/TySUtilu.dll
.dll windows:4 windows x86 arch:x86

a008632a5ab1b5de784efb061bb8f8e9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14
Signer

Actual PE Digest

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\TyScan\Sym\Release\TySUtilu.pdb

Imports

kernel32

CreateFileMappingW
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
MapViewOfFile
GetFileSize
WriteFile
SetLastError
SetFilePointer
ReadFile
GetLocalTime
UnmapViewOfFile
CloseHandle
GetFileAttributesW
CreateDirectoryW
GetLastError
DeleteFileW
OutputDebugStringW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

Exports

Exports

TBP_Close_File
TBP_Delete_From_Repository
TBP_Get_Object_Count
TBP_Get_Size_Of_Repository
TBP_Insert_Object_File
TBP_Insert_Object_Reg_Key
TBP_Insert_Object_Reg_Value
TBP_Is_Repository_Capable
TBP_Make_Category
TBP_Open_File
TBP_Read_Category
TBP_Read_Object
TBP_Restore_All_Object
TBP_Restore_Object
TBP_Restore_ObjectEx
TBP_Traverse_Repository

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/teexcept.dat
$COMMONFILES/nProtect Shared/Engine/tyav32u.dll
.dll windows:4 windows x86 arch:x86

021e6f8bb522faeb0c3bb252a119d5e3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9f:d2:8e:6f:09:25:85:0b:48:fe:fd:45:c6:31:13:9c:cf:76:cc:b3:5c:0b:48:3e:2c:38:29:cf:34:25:60:f2
Signer

Actual PE Digest

9f:d2:8e:6f:09:25:85:0b:48:fe:fd:45:c6:31:13:9c:cf:76:cc:b3:5c:0b:48:3e:2c:38:29:cf:34:25:60:f2

Digest Algorithm

sha256

PE Digest Matches

true

ca:b9:b3:c2:9c:1e:05:94:52:83:83:1d:d6:bc:ea:5d:02:1d:07:f5
Signer

Actual PE Digest

ca:b9:b3:c2:9c:1e:05:94:52:83:83:1d:d6:bc:ea:5d:02:1d:07:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenFileMappingW
GetFileAttributesW
GetCurrentThread
Module32NextW
Module32FirstW
Sleep
TerminateProcess
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
WaitForSingleObject
GetWindowsDirectoryW
MultiByteToWideChar
FindNextFileW
MoveFileW
GetLogicalDriveStringsW
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
SuspendThread
OpenThread
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
VirtualProtectEx
GetCurrentProcess
VirtualQuery
OpenEventW
LoadLibraryA
GetSystemDirectoryA
GetFileSize
OutputDebugStringW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetTempPathW
WriteConsoleW
GetStdHandle
OutputDebugStringA
FormatMessageW
GetSystemInfo
CreateFileA
SetFileTime
GetFileTime
FindFirstFileA
WritePrivateProfileStringW
MoveFileExW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
CreateEventW
QueryDosDeviceW
TerminateThread
CreateThread
DuplicateHandle
CreateRemoteThread
LocalFree
GetLogicalDrives
GetSystemDirectoryW
SetLastError
SetEvent
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetLongPathNameW
LeaveCriticalSection
EnterCriticalSection
OpenMutexW
CreateMutexW
GetTempFileNameW
SetEndOfFile
DeviceIoControl
GetShortPathNameW
FindFirstFileW
FindClose
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
Process32FirstW
Process32NextW
OpenProcess
ExpandEnvironmentStringsW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTickCount
CopyFileW
GetLastError
WideCharToMultiByte
WriteFile
SetFilePointer
ReadFile
GetVersionExW
GetDriveTypeW
CreateFileW
CloseHandle
GetLocalTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
RaiseException
SetConsoleCtrlHandler
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GlobalFree
GlobalAlloc
VirtualAlloc
VirtualProtect
VirtualFree
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
RtlUnwind
ExitProcess
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
TlsAlloc
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
SetStdHandle
DeleteFileA

advapi32

RegQueryValueExW
IsTextUnicode
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetUserNameW
LookupAccountNameW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
OpenThreadToken
ImpersonateSelf
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyW
OpenProcessToken
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW

ws2_32

WSCDeinstallProvider
WSCEnumProtocols
WSCInstallProvider
WSCGetProviderPath
WSACleanup

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

sfc

ord5

shlwapi

PathRemoveFileSpecW

imagehlp

MapFileAndCheckSumW

userenv

ExpandEnvironmentStringsForUserW

Exports

Exports

RecoverInlineHooking
TYAVSmartCure
TYAVSmartScan
TYAutoScanMemory
TYCheckBootVirus
TYCheckExceptList
TYCheckFile
TYCheckFileEx
TYCheckFileExW
TYCoreCheckBootVirus
TYCoreCheckFileCBCureEx
TYCoreCheckFileEx
TYCoreCheckFileExW
TYCoreGetEngineDateW
TYCoreInitEngine
TYCoreRecoveryBootVirus
TYCoreRecoveryFile
TYCoreRecoveryFileW
TYCoreSetOption
TYCoreSetReportCallBack
TYCoreUnInitEngine
TYCreateCache
TYCureMemory
TYCureProcess
TYDelInstance
TYDisablePattern
TYEnableNetworkScan
TYFlushBWTCache
TYGetBWTVer
TYGetBWTVerEx
TYGetBootInfo
TYGetEngineDate
TYGetEngineDateW
TYGetFileCRC
TYGetFileCRCEX
TYGetFileCRCEX2
TYGetFilePosCRC
TYGetPatternNum
TYInitEngine
TYListFile
TYListFileCRC
TYNewInstance
TYRecoveryBootVirus
TYRecoveryFile
TYRecoveryFileW
TYScanMemory
TYScanProcess
TYSetLiveUpdate
TYSetLoadLibDir
TYSetOption
TYSetServerSideScriptScan
TYSetYaraEnable
TYStopNetworkScan
TYUnInitEngine

Sections

.text
Size: 620KB - Virtual size: 619KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/tyavcuremap.dat
$COMMONFILES/nProtect Shared/Engine/tyavexcept.bin
.dll windows:4 windows x86 arch:x86

5c54715227e960c5019e7a45d4b9d02a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/tyavexcept.dat
$PLUGINSDIR/GetVersion.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsServicePackMajor
WindowsServicePackMinor
WindowsType
WindowsVersion

Sections

UPX0
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:5 windows x86 arch:x86

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 753B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/npeNSISUtil.dll
.dll windows:4 windows x86 arch:x86

310dbe8c6167d088f05900d59f1b65ef

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e6:50:64:4f:c5:64:7a:19:27:75:f7:4f:a2:b2:fe:37:83:f6:16:4b:1e:fd:06:e1:6c:89:1f:67:6a:53:32:81
Signer

Actual PE Digest

e6:50:64:4f:c5:64:7a:19:27:75:f7:4f:a2:b2:fe:37:83:f6:16:4b:1e:fd:06:e1:6c:89:1f:67:6a:53:32:81

Digest Algorithm

sha256

PE Digest Matches

true

39:72:b1:d6:f8:31:19:7a:6c:3f:62:74:dd:50:a8:47:20:3f:95:3f
Signer

Actual PE Digest

39:72:b1:d6:f8:31:19:7a:6c:3f:62:74:dd:50:a8:47:20:3f:95:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npeNSISUtil\build\bin\release\npeNSISUtil.pdb

Imports

kernel32

GetLocaleInfoW
LoadLibraryA
FlushFileBuffers
GetConsoleMode
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetModuleHandleA
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
ProcessIdToSessionId
Module32NextW
Module32FirstW
LocalAlloc
LocalFree
ReadFile
CreateProcessW
Sleep
CreatePipe
GetTickCount
SetLastError
GetUserDefaultUILanguage
ExpandEnvironmentStringsW
OpenMutexW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GlobalAlloc
GetLastError
lstrcpynW
TerminateThread
WaitForSingleObject
lstrcpyW
CreateThread
GlobalFree
CloseHandle
TerminateProcess
GetCurrentProcess
GetConsoleCP
CreateFileW
IsValidLocale
EnumSystemLocalesA
OpenProcess
FreeLibrary
LoadLibraryW
GetProcessHeap
HeapAlloc
GetSystemInfo
lstrcmpiW
GetModuleHandleW
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetProcAddress
HeapFree
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetModuleFileNameA
WriteFile
ExitProcess
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
SetStdHandle
GetFileType
SetFilePointer
SetHandleCount
GetStdHandle
GetStartupInfoA
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
VirtualFree

user32

GetSystemMetrics
wsprintfW
PostMessageW
IsWindowVisible
GetWindowTextLengthW
UpdateWindow
FindWindowW
GetWindow
GetWindowLongW
GetWindowThreadProcessId
GetDesktopWindow

advapi32

OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
DuplicateTokenEx
LookupPrivilegeValueW
ConvertStringSidToSidW
AdjustTokenPrivileges
SetTokenInformation
GetLengthSid
CreateProcessAsUserW
RegCreateKeyW
QueryServiceStatus
DeleteService
ControlService
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
CloseServiceHandle
RegEnumValueW
RegQueryInfoKeyW
ConvertSidToStringSidW
GetUserNameW
LookupAccountSidW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
RegCloseKey
OpenSCManagerW
RegSetValueExW
GetTokenInformation

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoTaskMemFree

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertOpenStore

ws2_32

inet_ntoa
WSACleanup
gethostbyname
WSAStartup

iphlpapi

GetAdaptersInfo
GetNetworkParams

netapi32

NetApiBufferFree
NetLocalGroupGetMembers
NetGetJoinInformation

psapi

EnumProcessModules
GetModuleBaseNameW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

shlwapi

PathFileExistsW

Exports

Exports

Execute
FindDevice
FindProcess
KillProcess
KillProcessByMsg
addCertMS
browserKill
compareVersion
compareVersionList
createService
deleteService
executeIExplore
executeIExploreX64
getIPByHostName
getLanguage
getLoginUserSHFolderPath
getModuleList
getOption
getPendingRegFindValue
getUserAppDataLowPathCanBeElevatedByUAC
isEualsGWIPAndDNSIP
isExistCertFF
isExistCertFF2nd
isExistCertMS
isLoadDrv
isModuleLoadBrowser
isTilonPc
isVistaOrLater
killProcessName
openMutex
setNPN55UpdateVer
setNPSJpnUpdateVer
setNPSUpdateVer
setWindowsFirewallAllowed
startService
stopService

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:5 windows x86 arch:x86

8700d0ebbb41c81ea52718af1ab70a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess

user32

CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/nProtectUninstaller.exe
.exe windows:4 windows x86 arch:x86

cdb95ccdd0343d1a67a51f7542a5f554

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5b:08:27:7b:d4:a6:e0:c0:cb:03:68:d1:8f:f3:ce:d1:5b:bb:76:47:2f:91:35:96:25:01:c2:2a:d9:a9:20:4e
Signer

Actual PE Digest

5b:08:27:7b:d4:a6:e0:c0:cb:03:68:d1:8f:f3:ce:d1:5b:bb:76:47:2f:91:35:96:25:01:c2:2a:d9:a9:20:4e

Digest Algorithm

sha256

PE Digest Matches

true

4c:8a:91:af:90:41:ab:4a:a1:3b:44:57:ea:e4:50:7f:cb:a5:90:78
Signer

Actual PE Digest

4c:8a:91:af:90:41:ab:4a:a1:3b:44:57:ea:e4:50:7f:cb:a5:90:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\001_build\nProtectZ\product\npn60\nProtectUninstaller\build\bin\release\nProtectUninstaller.pdb

Imports

psapi

GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathAddExtensionW
PathRemoveBackslashW
PathIsDirectoryW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW

kernel32

FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
Sleep
GetModuleFileNameA
LoadLibraryW
GetProcAddress
FreeLibrary
FindResourceW
RemoveDirectoryW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
CloseHandle
CreateFileW
WriteFile
CreateProcessW
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
ResumeThread
MoveFileExW
GetFileAttributesW
GetModuleHandleA
GetTickCount
GetCurrentProcessId
GetModuleHandleW
GetSystemDirectoryW
VirtualQuery
CreateDirectoryW
LocalAlloc
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
GetStdHandle
VirtualAlloc
Process32NextW
OpenProcess
SetFileAttributesW
DeleteFileW
ExitThread
RaiseException
ExitProcess
RtlUnwind
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualProtect
CreateThread
HeapSize
InterlockedCompareExchange
CreateMutexA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
IsBadReadPtr
GetStartupInfoW
GetFileTime
SetErrorMode
SystemTimeToFileTime
GlobalFlags
InterlockedIncrement
lstrlenA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InitializeCriticalSection
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
MulDiv
GlobalUnlock
GlobalFindAtomW
CompareStringW
GetVersionExA
InterlockedDecrement
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
LoadLibraryExW
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpW
lstrlenW
WritePrivateProfileStringW
FreeResource
GlobalAlloc
GlobalFree
GlobalAddAtomW
GetVersion
GetSystemInfo
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
ResetEvent
SetEvent
CreateEventW
CreateEventA
GetSystemTimeAsFileTime
ReleaseMutex
OpenMutexW
CreateMutexW
MoveFileW
SetFilePointer
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocalTime
FormatMessageW
OutputDebugStringW
LoadLibraryA
GetSystemDirectoryA
GetFileSize
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetUserDefaultLCID
EnumUILanguagesW
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
ReadFile
ProcessIdToSessionId
WaitForSingleObject
TerminateProcess
Module32NextW
Module32FirstW
CreateRemoteThread
GetWindowsDirectoryW
GetPrivateProfileStringW
GetLastError
FindNextFileW
FindFirstFileW
FindClose

user32

SetCapture
InvalidateRgn
InvalidateRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
LoadCursorW
GetSysColorBrush
CharUpperW
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ShowWindow
UnregisterClassA
MoveWindow
SetWindowTextW
IsDialogMessageW
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
ReleaseDC
GetDC
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
IsWindow
SetFocus
GetWindowTextW
GetForegroundWindow
SetActiveWindow
ReleaseCapture
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetForegroundWindow
GetNextDlgGroupItem
MessageBeep
UnregisterClassW
RegisterClipboardFormatW
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
UnhookWindowsHookEx
GetLastActivePopup
IsWindowEnabled
PostQuitMessage
SetWindowContextHelpId
GetParent
MapDialogRect
SetWindowPos
SetCursor
IsWindowVisible
GetWindowThreadProcessId
GetWindowLongW
GetWindow
PostMessageW
FindWindowExW
FindWindowW
SetRect
DrawIcon
KillTimer
GetClientRect
GetSystemMetrics
IsIconic
GetSystemMenu
SetTimer
GetWindowRect
LoadIconW
SendMessageW
AppendMenuW
EnableWindow
MessageBoxW
GetClassInfoW
PostThreadMessageW
DispatchMessageW

gdi32

GetTextColor
GetRgnBox
GetMapMode
GetBkColor
GetDeviceCaps
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateRectRgnIndirect
CreateBitmap
SaveDC
RestoreDC
SetMapMode
DeleteObject
GetViewportExtEx
PtVisible
GetWindowExtEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

LookupPrivilegeValueW
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
RegDeleteValueW
AdjustTokenPrivileges
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegCreateKeyW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
ConvertSidToStringSidW
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
QueryServiceStatus
DeleteService
ControlService
QueryServiceStatusEx
RegCloseKey
OpenServiceW
OpenSCManagerW
CloseServiceHandle
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
RegEnumKeyExW
RegOpenKeyExW
GetTokenInformation
CreateProcessAsUserW
SetKernelObjectSecurity
SetSecurityDescriptorDacl
MakeAbsoluteSD
SetEntriesInAclW
GetSidSubAuthorityCount
BuildExplicitAccessWithNameW
GetSidSubAuthority
GetUserNameW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
RegSetValueExW

shell32

SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoGetClassObject
CoTaskMemAlloc
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy

imm32

ImmDisableIME

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

ws2_32

WSAStartup
inet_addr
gethostbyaddr
WSACleanup
ntohs
WSAGetLastError
htons
getservbyname
htonl
inet_ntoa
getservbyport
gethostbyname
WSASetLastError

userenv

DestroyEnvironmentBlock

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptQueryObject
CryptMsgGetParam

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

HttpQueryInfoW
InternetReadFile
HttpSendRequestExW
InternetWriteFile
HttpAddRequestHeadersW
InternetSetOptionW
HttpOpenRequestW
InternetAttemptConnect
InternetCloseHandle
InternetConnectW
InternetOpenW
HttpSendRequestW
HttpEndRequestW

wintrust

WinVerifyTrust

Sections

.text
Size: 632KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/npcf_win_32u.dll
.dll windows:4 windows x86 arch:x86

e173053aab7169b17490d0773c9dff4a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\docs\암호모듈검증_프로젝트\제출물\nprotect_crypto_v1.1_2014.07.14\source\winodws\dll\release\npcf_win_32u.pdb

Imports

kernel32

GetTickCount
GetProcessHeap
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryW
QueryPerformanceFrequency
GetCurrentThreadId
CloseHandle
GetVersionExW
GetCurrentProcessId
GetSystemTime
FreeLibrary
QueryPerformanceCounter
GetProcAddress
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingW
GetFileSize
DuplicateHandle
GetCurrentProcess
OpenProcess
Sleep
CreateThread
TerminateThread
LCMapStringW
LCMapStringA
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA

user32

FindWindowW
GetSystemMetrics
GetCursorPos

ole32

CoCreateGuid

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/nppb.dll
.dll windows:4 windows x86 arch:x86

00db911b28a8cd6b64fe48e8520f85bb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f
Signer

Actual PE Digest

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f

Digest Algorithm

sha256

PE Digest Matches

true

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc
Signer

Actual PE Digest

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nppb\release\nppb.pdb

Imports

kernel32

GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
WriteFile
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/npx/npcUnInstallPolicy.npx
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/npx/npluninstall.npx
$SYSDIR/TKCtrl2k.sys
.sys windows:6 windows x86 arch:x86

d4557be79e0f9831af3cca19a058f6a4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c3:be:a3:ca:a2:f0:9a:80:1a:66:c1:03:70:1b:6f:f8:d3:0c:bf:6f:a5:74:58:13:7b:98:f7:da:01:78:d1:e7
Signer

Actual PE Digest

c3:be:a3:ca:a2:f0:9a:80:1a:66:c1:03:70:1b:6f:f8:d3:0c:bf:6f:a5:74:58:13:7b:98:f7:da:01:78:d1:e7

Digest Algorithm

sha256

PE Digest Matches

true

e8:4b:2c:85:73:6a:54:14:4b:b4:8d:f6:34:47:bc:16:bb:3a:e7:26
Signer

Actual PE Digest

e8:4b:2c:85:73:6a:54:14:4b:b4:8d:f6:34:47:bc:16:bb:3a:e7:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\users\inca-dev\jenkin~1\jobs\engdev~1\worksp~1\trunk\bin\free\i386\TKCtrl2k.pdb

Imports

ntoskrnl.exe

PsGetCurrentProcessId
memcpy
KeInitializeEvent
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoUnregisterPlugPlayNotification
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
ObReferenceObjectByHandle
ExEventObjectType
ObfDereferenceObject
KeWaitForSingleObject
KeSetEvent
ZwClose
PsCreateSystemThread
_allmul
PsGetCurrentThreadId
PsThreadType
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsTerminateSystemThread
ObfReferenceObject
PsLookupProcessByProcessId
KeUnstackDetachProcess
ZwQueryObject
KeStackAttachProcess
MmIsAddressValid
IoGetCurrentProcess
ObQueryNameString
NtClose
ZwSetInformationObject
wcsrchr
ZwWriteFile
ZwCreateFile
ExfInterlockedInsertTailList
ZwQueryDirectoryObject
ZwOpenDirectoryObject
strrchr
ZwDeleteFile
ZwOpenFile
ZwSetInformationFile
ZwQueryInformationFile
KeTickCount
KeQueryActiveProcessors
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
MmGetSystemRoutineAddress
_stricmp
_wcsicmp
RtlImageDirectoryEntryToData
KeWaitForMultipleObjects
PsLookupThreadByThreadId
KeBugCheckEx
ZwQuerySystemInformation
DbgPrint
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
PsSetCreateThreadNotifyRoutine
IoRegisterPlugPlayNotification
_wcsnicmp
memset
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
ObOpenObjectByName
IoDriverObjectType
IoGetBaseFileSystemDeviceObject
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExDeleteNPagedLookasideList
PsGetVersion
_strnicmp
strncpy
RtlFreeUnicodeString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeReadStateEvent
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapLockedPages
ZwDeleteValueKey
RtlUnwind

hal

KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
ExReleaseFastMutex
ExAcquireFastMutex
KeGetCurrentIrql

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKCtrl2k64.sys
.sys windows:6 windows x64 arch:x64

259b5a43f6cc111337444a7d5f8e265d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:78:07:7a:a2:9a:9c:e5:11:c9:c5:90:30:c0:1f:5d:36:1a:db:d4:bb:d3:62:f9:76:8b:29:09:9e:8f:02:2b
Signer

Actual PE Digest

27:78:07:7a:a2:9a:9c:e5:11:c9:c5:90:30:c0:1f:5d:36:1a:db:d4:bb:d3:62:f9:76:8b:29:09:9e:8f:02:2b

Digest Algorithm

sha256

PE Digest Matches

true

8d:41:81:c7:72:19:62:5f:d0:08:3f:6e:c4:fc:b8:88:02:16:36:d8
Signer

Actual PE Digest

8d:41:81:c7:72:19:62:5f:d0:08:3f:6e:c4:fc:b8:88:02:16:36:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\users\inca-dev\jenkin~1\jobs\engdev~1\worksp~1\trunk\bin\free\amd64\TKCtrl2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
RtlInitAnsiString
PsSetCreateThreadNotifyRoutine
IoIs32bitProcess
ZwQuerySystemInformation
PsSetCreateProcessNotifyRoutine
ZwUnloadDriver
PsCreateSystemThread
IoGetCurrentProcess
ExEventObjectType
ZwClose
IoUnregisterPlugPlayNotification
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
DbgPrint
ExReleaseFastMutex
ExAcquireFastMutex
PsLookupProcessByProcessId
_wcsnicmp
ZwQueryObject
KeUnstackDetachProcess
ObQueryNameString
ZwCreateFile
wcsrchr
PsTerminateSystemThread
NtClose
ObfReferenceObject
MmIsAddressValid
ZwSetInformationObject
ZwWriteFile
KeStackAttachProcess
KeReleaseSpinLock
ExInterlockedInsertTailList
KeAcquireSpinLockRaiseToDpc
ZwOpenDirectoryObject
ZwQueryDirectoryObject
strrchr
KeSetTargetProcessorDpc
KeQueryActiveProcessors
KeInitializeDpc
ZwSetInformationFile
KeInsertQueueDpc
ZwDeleteFile
ZwOpenFile
ZwQueryInformationFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
KeWaitForMultipleObjects
PsLookupThreadByThreadId
_wcsicmp
KeBugCheckEx
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
_stricmp
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
IoGetBaseFileSystemDeviceObject
KeLeaveCriticalRegion
ObOpenObjectByName
ExInitializeNPagedLookasideList
ZwQuerySymbolicLinkObject
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlUnicodeStringToAnsiString
ZwDeleteValueKey
ExpInterlockedPopEntrySList
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
IoDriverObjectType
MmMapLockedPagesSpecifyCache
ExReleaseResourceLite
IofCompleteRequest
ExQueryDepthSList
RtlFreeAnsiString
PsGetVersion
ExDeleteResourceLite
ExInitializeResourceLite
ExDeleteNPagedLookasideList
IoAllocateMdl

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKCtrlU.dll
.dll windows:4 windows x86 arch:x86

e497af0c2978c4c2c39fccc20650b253

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

45:68:1f:93:1f:aa:f1:06:62:9f:72:93:94:10:c0:28:d5:c8:4d:50:15:2c:01:10:a6:41:2a:32:1c:ca:fb:b8
Signer

Actual PE Digest

45:68:1f:93:1f:aa:f1:06:62:9f:72:93:94:10:c0:28:d5:c8:4d:50:15:2c:01:10:a6:41:2a:32:1c:ca:fb:b8

Digest Algorithm

sha256

PE Digest Matches

true

a5:3d:60:a0:e8:57:53:0b:02:21:c7:2d:4f:e5:06:e9:c5:e9:d5:b3
Signer

Actual PE Digest

a5:3d:60:a0:e8:57:53:0b:02:21:c7:2d:4f:e5:06:e9:c5:e9:d5:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\engdev_0902_tkctrl\trunk\dll\tkctrl\x86\releaseu\TKCtrlU.pdb

Imports

user32

MessageBoxW
PostQuitMessage

advapi32

CloseServiceHandle
LookupAccountNameW
ConvertSidToStringSidW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyW
CreateServiceW
StartServiceW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerW
RegOpenKeyA
GetUserNameA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
ConvertSidToStringSidA
LookupAccountNameA

kernel32

CompareStringW
EnterCriticalSection
CompareStringA
OutputDebugStringW
DeviceIoControl
GetLastError
GetSystemDirectoryW
LocalFree
FormatMessageW
GetProcAddress
LoadLibraryW
GetVolumeInformationW
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
ReadFile
GetQueuedCompletionStatus
CloseHandle
GetSystemInfo
TerminateThread
ConnectNamedPipe
CreateIoCompletionPort
CreateNamedPipeW
GetCurrentProcess
CreateRemoteThread
GetModuleHandleW
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
OpenProcess
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
WriteFile
SetNamedPipeHandleState
Sleep
CreateFileW
DisconnectNamedPipe
FlushFileBuffers
ExpandEnvironmentStringsW
GetVersion
SetLastError
GetTickCount
InitializeCriticalSection
InterlockedDecrement
LeaveCriticalSection
SetEnvironmentVariableA
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
GetComputerNameA
GetWindowsDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetVersionExW
GetFileAttributesW
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetLocaleInfoW
GetTimeZoneInformation
CreateFileA

Exports

Exports

TKCtrlClose
TKCtrlCloseACI
TKCtrlCloseDataQueue
TKCtrlCloseDataQueueEx
TKCtrlCloseHandle
TKCtrlCloseNtfsFile
TKCtrlControlACI
TKCtrlControlVolumeScan
TKCtrlDeleteFile
TKCtrlDeleteFileA
TKCtrlDeleteFileW
TKCtrlEnumDirectoryObject
TKCtrlFindClose
TKCtrlFindFirstFile
TKCtrlFindFirstFileA
TKCtrlFindFirstFileQ
TKCtrlFindFirstFileQA
TKCtrlFindFirstFileQW
TKCtrlFindFirstFileW
TKCtrlFindNextFile
TKCtrlFindNextFileA
TKCtrlFindNextFileQ
TKCtrlFindNextFileQA
TKCtrlFindNextFileQW
TKCtrlFindNextFileW
TKCtrlGetAllPolicyLog
TKCtrlGetDllVersion
TKCtrlGetDrvVersion
TKCtrlGetFileSize
TKCtrlGetFileSizeEx
TKCtrlGetHiddenModule
TKCtrlGetModuleInfo
TKCtrlGetModuleList
TKCtrlGetProcessList
TKCtrlGetProcessListEx
TKCtrlHideModule
TKCtrlInit
TKCtrlInitACI
TKCtrlInitCharacterSet
TKCtrlInitDataQueue
TKCtrlInitDataQueueEx
TKCtrlLoadAtStartUp
TKCtrlLoadDriver
TKCtrlOpenFile
TKCtrlOpenFileA
TKCtrlOpenFileW
TKCtrlOpenNtfsFile
TKCtrlReadFile
TKCtrlReadNtfsFile
TKCtrlRegCloseContext
TKCtrlRegCloseKey
TKCtrlRegCreateContext
TKCtrlRegCreateContextA
TKCtrlRegCreateContextW
TKCtrlRegEnumKeyEx
TKCtrlRegEnumKeyExA
TKCtrlRegEnumKeyExW
TKCtrlRegEnumValue
TKCtrlRegEnumValueA
TKCtrlRegEnumValueW
TKCtrlRegOpenKey
TKCtrlRegOpenKeyA
TKCtrlRegOpenKeyW
TKCtrlRegQueryInfoKey
TKCtrlRegQueryInfoKeyA
TKCtrlRegQueryInfoKeyW
TKCtrlRegQueryValueEx
TKCtrlRegQueryValueExA
TKCtrlRegQueryValueExW
TKCtrlRegisterSyncThreadNotify
TKCtrlSetAppContext
TKCtrlSetPauseDataQueue
TKCtrlSetQueryInfo
TKCtrlSetQueryInfoEx
TKCtrlStartACI
TKCtrlStartVolumeScan
TKCtrlStopACI
TKCtrlUnloadDriver
TKCtrlUnregisterSyncThreadNotify

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFW.sys
.sys windows:6 windows x86 arch:x86

6bacbf582b0e8a057bfab5b43a361842

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:8d:2d:ac:a4:46:65:54:6b:b5:87:97:81:91:a8:bf
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

31-10-2007 00:00

Not After

30-10-2017 23:59

Subject

CN=GeoTrust Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

bc:ab:62:eb:2b:36:50:c5:4b:e7:0e:3b:19:9e:a0:dc:68:8e:5f:34:f0:50:94:92:24:c1:55:8c:1c:94:e7:59
Signer

Actual PE Digest

bc:ab:62:eb:2b:36:50:c5:4b:e7:0e:3b:19:9e:a0:dc:68:8e:5f:34:f0:50:94:92:24:c1:55:8c:1c:94:e7:59

Digest Algorithm

sha256

PE Digest Matches

true

00:33:5a:0f:a8:9c:a2:87:fb:42:c4:95:1a:5a:66:89:19:f3:12:76
Signer

Actual PE Digest

00:33:5a:0f:a8:9c:a2:87:fb:42:c4:95:1a:5a:66:89:19:f3:12:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\projec~1\en005c~1\branches\if1_rb~2.01_\bin\free\i386\TKFW.pdb

Imports

ntoskrnl.exe

memset
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
KeSetEvent
KeReadStateEvent
PsGetCurrentProcessId
ExAllocatePoolWithTag
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmUnmapLockedPages
ObReferenceObjectByHandle
KeInitializeMutex
KeInitializeEvent
ObfDereferenceObject
PsGetVersion
_strnicmp
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
DbgPrint
IoGetCurrentProcess
KeQueryTimeIncrement
memcpy
_alldiv
_allmul
memchr
KeReleaseMutex
KeWaitForSingleObject
MmIsAddressValid
PsGetCurrentThreadId
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
strncpy
ZwClose
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
MmMapLockedPagesSpecifyCache
IofCompleteRequest
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
RtlCopyUnicodeString
KeTickCount
IoRegisterShutdownNotification
ObQueryNameString
PsLookupProcessByProcessId
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnwind
RtlUnicodeToMultiByteN

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFWFV.cat
$SYSDIR/TKFWFV.inf
$SYSDIR/TKFWFV.sys
.sys windows:6 windows x86 arch:x86

28159e3467957b64802a7f0e2bc2727a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e0:67:1a:b8:91:5c:e2:1a:91:1b:66:f5:f4:e8:15:33:d1:97:1e:55
Signer

Actual PE Digest

e0:67:1a:b8:91:5c:e2:1a:91:1b:66:f5:f4:e8:15:33:d1:97:1e:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svn\engdev~2\branches\if1_rb~3.01\bin\free\i386\TKFWFV.pdb

Imports

ntoskrnl.exe

PsCreateSystemThread
ObReferenceObjectByHandle
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
KeGetCurrentThread
memcpy
PsTerminateSystemThread
_allmul
KeDelayExecutionThread
memset
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
IoRegisterShutdownNotification
ObfReferenceObject
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsRemoveLoadImageNotifyRoutine
RtlInitUnicodeString
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPagesSpecifyCache
IoCreateSymbolicLink
IoCreateDevice
ExFreePoolWithTag
ExAllocatePoolWithTag
KeTickCount
KeBugCheckEx
KeSetPriorityThread
RtlUnwind
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoGetCurrentProcess
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
PsGetVersion
_strnicmp
RtlQueryRegistryValues
memmove

hal

KfReleaseSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor
KfAcquireSpinLock

ndis.sys

NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFRegisterFilterDriver
NdisAllocateCloneOidRequest
NdisFIndicateReceiveNetBufferLists
NdisFSendNetBufferLists
NdisFreeCloneOidRequest
NdisFOidRequestComplete
NdisFDeregisterFilterDriver
NdisFOidRequest
NdisFCancelSendNetBufferLists
NdisFreeMdl
NdisFreeNetBufferList
NdisFSendNetBufferListsComplete
NdisFReturnNetBufferLists
NdisFNetPnPEvent
NdisFDevicePnPEventNotify
NdisFIndicateStatus
NdisFCancelOidRequest
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisFSetAttributes
NdisAllocateMemoryWithTagPriority
NdisSetEvent
NdisFreeMemory

fwpkclnt.sys

FwpsInjectionHandleCreate0
FwpmTransactionAbort0
FwpsInjectionHandleDestroy0
FwpsCalloutRegister0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmEngineClose0
FwpsCalloutUnregisterById0

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFWFV64.cat
$SYSDIR/TKFWFV64.sys
.sys windows:6 windows x64 arch:x64

282629e63807b64dc1b2081f6cf30782

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d4:2e:3c:3c:e2:70:e2:c7:98:4f:88:18:d2:6e:3b:d6:b2:a4:37:e7
Signer

Actual PE Digest

d4:2e:3c:3c:e2:70:e2:c7:98:4f:88:18:d2:6e:3b:d6:b2:a4:37:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\svn\engdev~2\branches\if1_rb~3.01\bin\free\amd64\TKFWFV64.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
ExFreePoolWithTag
ExAllocatePoolWithTag
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
MmMapLockedPagesSpecifyCache
IoDeleteDevice
IoRegisterShutdownNotification
IoDeleteSymbolicLink
KeAcquireSpinLockRaiseToDpc
KeAcquireSpinLockAtDpcLevel
ObfReferenceObject
PsRemoveLoadImageNotifyRoutine
KeReleaseSpinLockFromDpcLevel
KeReleaseSpinLock
RtlInitUnicodeString
ObfDereferenceObject
ObReferenceObjectByHandle
ZwClose
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
PsSetCreateProcessNotifyRoutine
KeSetPriorityThread
PsSetLoadImageNotifyRoutine
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
_strnicmp
RtlUnicodeStringToAnsiString
IoGetCurrentProcess
RtlFreeAnsiString
PsGetVersion
RtlQueryRegistryValues
__C_specific_handler

hal

KeStallExecutionProcessor

ndis.sys

NdisFSendNetBufferLists
NdisOpenConfigurationEx
NdisAllocateCloneOidRequest
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisFDevicePnPEventNotify
NdisFOidRequestComplete
NdisFOidRequest
NdisFIndicateStatus
NdisFCancelOidRequest
NdisFSetAttributes
NdisFCancelSendNetBufferLists
NdisFDeregisterFilterDriver
NdisFreeMemory
NdisSetEvent
NdisAllocateMemoryWithTagPriority
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisFSendNetBufferListsComplete
NdisFreeNetBufferList
NdisFreeMdl
NdisFRegisterFilterDriver
NdisFreeCloneOidRequest
NdisFNetPnPEvent
NdisCloseConfiguration

fwpkclnt.sys

FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpmCalloutAdd0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsCalloutUnregisterById0
FwpmEngineClose0

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFWU.dll
.dll windows:4 windows x86 arch:x86

ec8aeccecc6a4f3ad1b2a8c83238261c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05-05-2015 00:00

Not After

31-12-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:22:eb:94:f2:f3:e5:e3:37:b1:c1:03:6c:a6:a7:2a:f8:59:c6:c9
Signer

Actual PE Digest

c0:22:eb:94:f2:f3:e5:e3:37:b1:c1:03:6c:a6:a7:2a:f8:59:c6:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\_src\kernel\engdev_0801_tkfw\trunk\2.0\dll\tkfw\releaseu\TKFWU_dll.pdb

Imports

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupCopyOEMInfW

kernel32

FormatMessageW
OutputDebugStringW
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetSystemDirectoryW
SetEvent
GetShortPathNameW
lstrlenW
TerminateThread
GetCurrentProcessId
CreateEventW
GetCurrentProcess
VirtualFree
VirtualAlloc
DuplicateHandle
LocalFree
ReadProcessMemory
LocalAlloc
HeapFree
GetProcessHeap
lstrlenA
InterlockedDecrement
SleepEx
InterlockedIncrement
OutputDebugStringA
GetVersionExW
GetSystemInfo
CompareStringW
CompareStringA
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
WriteConsoleW
GetTickCount
Sleep
SetLastError
GetVersion
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
SetEnvironmentVariableA
GetUserDefaultLCID
EnumSystemLocalesA
OpenProcess
GetConsoleOutputCP
WriteConsoleA
SetConsoleCtrlHandler
SetStdHandle
HeapSize
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
GetFileAttributesW
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
IsValidLocale

user32

PostThreadMessageW
MessageBoxW
GetSystemMetrics
SendMessageTimeoutW
SendMessageW
wsprintfW

advapi32

LookupPrivilegeValueW
RegDeleteValueW
OpenProcessToken
AdjustTokenPrivileges
RegOpenKeyW
RegEnumKeyW
RegQueryValueExW
RegCloseKey
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize

Exports

Exports

TKFWCallbackMsgComplete
TKFWCanDoDrvUnload
TKFWClearTrafficInfo
TKFWCloseDrv
TKFWCloseDrvEx
TKFWDelAllAllowPId
TKFWDelAllBlockPId
TKFWDelAllFWCommonAllRules
TKFWDelAllFWCommonRules
TKFWDelAllIpGroup
TKFWDelAllMailExt
TKFWDelAllPortGroup
TKFWDelAllPrntSvr
TKFWDelAllProcAuth
TKFWDelAllShowShareIp
TKFWDelAllSmartStealthPId
TKFWDelAllTimeGroup
TKFWDelAllowPId
TKFWDelBlockPId
TKFWDelFWCommonRule
TKFWDelIpGroup
TKFWDelIpGroupByNum
TKFWDelMailExt
TKFWDelPortGroup
TKFWDelPortGroupByNum
TKFWDelPrntSvr
TKFWDelProcAuth
TKFWDelShowShareIp
TKFWDelSmartStealthPId
TKFWDelTimeGroup
TKFWDelTimeGroupByNum
TKFWDelTimeGroupEx
TKFWDeleteAllStaticGatewayMacs
TKFWDeleteAllSuspiciousThreads
TKFWDeleteAllWirelessWhiteListAPMacs
TKFWDeleteStaticGatewayMac
TKFWDeleteSuspiciousThread
TKFWDeleteWirelessWhiteListAPMac
TKFWGetListenStatus
TKFWGetSharedMem
TKFWGetTrafficInfo
TKFWGetVersion
TKFWInitDrv
TKFWInitDrvEx
TKFWInsAllowPId
TKFWInsBlockPId
TKFWInsFWCommonRule
TKFWInsIpGroup
TKFWInsMailExt
TKFWInsPortGroup
TKFWInsPrntSvr
TKFWInsProcAuth
TKFWInsShowShareIp
TKFWInsSmartStealthPId
TKFWInsTimeGroup
TKFWInsTimeGroupEx
TKFWInsertStaticGatewayMac
TKFWInsertSuspiciousThread
TKFWInsertWirelessWhiteListAPMac
TKFWInstallDrv
TKFWMACSpoofDetect
TKFWMACSpoofRecover
TKFWModFWCommonRule
TKFWModPrntSvr
TKFWModProcAuth
TKFWModShowShareIp
TKFWRegCallbackFunc
TKFWRegThreadCallbackMsg
TKFWReghWndCallbackMsg
TKFWSelectFWFunc
TKFWSendPkt
TKFWSetAppReady
TKFWSetExcludeProcessPathOnProcAuth
TKFWSetFWPause
TKFWSetNetworkStop
TKFWSetPolicy
TKFWSetRedirIp
TKFWSetSSNTimeOut
TKFWStopWhileNotRunning
TKFWUninstallDrv

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 524KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFsAv.sys
.sys windows:6 windows x86 arch:x86

fc808ac055b42537a527601e69fc124a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\project\nos-d\engdev_0609_tkfsav\trunk\2.0\bin\free\i386\TKFsAv.pdb

Imports

ntoskrnl.exe

PsGetCurrentProcessId
PsGetCurrentThreadId
ExInitializeResourceLite
ObfDereferenceObject
ObReferenceObjectByHandle
PsThreadType
ExEventObjectType
KeInitializeSemaphore
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
_allmul
memcpy
KeResetEvent
KeSetEvent
ExfInterlockedRemoveHeadList
IoGetDeviceObjectPointer
KeStackAttachProcess
IofCallDriver
IoBuildDeviceIoControlRequest
ObOpenObjectByPointer
PsReferencePrimaryToken
IoGetCurrentProcess
ZwClose
ZwQueryInformationToken
wcsncmp
wcsncat
_wcsnicmp
KeInitializeEvent
ZwUnloadDriver
ExFreePoolWithTag
DbgPrint
KeReleaseSemaphore
KeWaitForSingleObject
KeGetCurrentThread
KeUnstackDetachProcess
KeReadStateEvent
_alldiv
ZwWriteFile
_vsnprintf
ZwCreateFile
towlower
wcsrchr
ExAcquireResourceSharedLite
PsProcessType
ZwQuerySystemInformation
IoThreadToProcess
ZwOpenProcess
ZwQueryObject
PsLookupProcessByProcessId
MmIsAddressValid
PsCreateSystemThread
PsTerminateSystemThread
ZwTerminateProcess
ObQueryNameString
IoFileObjectType
MmUnmapViewOfSection
KeTickCount
KeBugCheckEx
IoCreateDevice
IoCreateSymbolicLink
memset
ExDeleteResourceLite
RtlCopyUnicodeString
RtlInitUnicodeString
IoDeleteSymbolicLink
ExfInterlockedInsertTailList
IoDeleteDevice
RtlAnsiCharToUnicodeChar
ObOpenObjectByName
IoDriverObjectType
IofCompleteRequest
ExAllocatePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExDeleteNPagedLookasideList
PsGetVersion
_strnicmp
strncpy
ProbeForRead
MmGetSystemRoutineAddress
PsReferenceImpersonationToken
strncmp
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeClearEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapLockedPages
_stricmp
ZwQueryValueKey
ZwOpenKey
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

fltmgr.sys

FltEnumerateVolumes
FltGetVolumeName
FltObjectDereference
FltQueryInformationFile

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFsAv64.sys
.sys windows:6 windows x64 arch:x64

197b7cac7a0e0e10d3ba3e98fe4da126

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\project\nos-d\engdev_0609_tkfsav\trunk\2.0\bin\free\amd64\TKFsAv64.pdb

Imports

ntoskrnl.exe

IoDeleteDevice
KeSetEvent
IoIs32bitProcess
KeReleaseSpinLock
KeEnterCriticalRegion
ZwUnloadDriver
ExEventObjectType
ExReleaseResourceLite
KeInitializeSemaphore
ObReferenceObjectByHandle
PsThreadType
ExInterlockedRemoveHeadList
ExDeleteResourceLite
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
ExInitializeResourceLite
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
_wcsnicmp
PsReferencePrimaryToken
wcsncat
IoGetDeviceObjectPointer
IoGetCurrentProcess
ZwClose
wcsncmp
ZwQueryInformationToken
RtlInitUnicodeString
KeStackAttachProcess
IofCallDriver
ExFreePoolWithTag
KeInitializeEvent
ExInterlockedInsertTailList
KeReadStateEvent
KeUnstackDetachProcess
KeWaitForSingleObject
KeReleaseSemaphore
DbgPrint
ZwCreateFile
_vsnprintf
ZwWriteFile
towlower
wcsrchr
ExAcquireResourceSharedLite
IoThreadToProcess
PsProcessType
PsLookupProcessByProcessId
ZwQueryObject
ZwQuerySystemInformation
ZwOpenProcess
MmIsAddressValid
PsCreateSystemThread
PsTerminateSystemThread
ZwTerminateProcess
MmUnmapViewOfSection
ObQueryNameString
IoFileObjectType
KeBugCheckEx
KeLeaveCriticalRegion
KeResetEvent
IoDeleteSymbolicLink
ObOpenObjectByPointer
ExAcquireResourceExclusiveLite
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
_stricmp
_strnicmp
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
RtlConvertSidToUnicodeString
strncmp
RtlAnsiStringToUnicodeString
ObOpenObjectByName
ExInitializeNPagedLookasideList
ZwQuerySymbolicLinkObject
PsReferenceImpersonationToken
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ExpInterlockedPopEntrySList
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
RtlFreeUnicodeString
strncpy
IoDriverObjectType
MmMapLockedPagesSpecifyCache
ExSystemTimeToLocalTime
ZwQueryValueKey
IofCompleteRequest
ExQueryDepthSList
RtlTimeToTimeFields
RtlFreeAnsiString
PsGetVersion
ExDeleteNPagedLookasideList
IoAllocateMdl
ZwOpenKey
__C_specific_handler

fltmgr.sys

FltGetVolumeName
FltEnumerateVolumes
FltObjectDereference
FltQueryInformationFile

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFsFt.sys
.sys windows:6 windows x86 arch:x86

6a28edfa5c6de8f65372b27385104cc0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:8d:2d:ac:a4:46:65:54:6b:b5:87:97:81:91:a8:bf
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

31-10-2007 00:00

Not After

30-10-2017 23:59

Subject

CN=GeoTrust Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

74:8c:9e:85:d0:2d:4d:f6:66:67:1c:74:90:94:35:52:53:7f:56:35:a3:b2:c9:05:70:22:c2:30:30:97:c0:67
Signer

Actual PE Digest

74:8c:9e:85:d0:2d:4d:f6:66:67:1c:74:90:94:35:52:53:7f:56:35:a3:b2:c9:05:70:22:c2:30:30:97:c0:67

Digest Algorithm

sha256

PE Digest Matches

true

a2:8a:c6:77:66:6e:66:c9:60:77:79:f1:24:c1:d8:b0:d2:75:6a:7a
Signer

Actual PE Digest

a2:8a:c6:77:66:6e:66:c9:60:77:79:f1:24:c1:d8:b0:d2:75:6a:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\worksp~1\engdev~3.0\trunk\bin\free\i386\TKFsFt.pdb

Imports

ntoskrnl.exe

KeTickCount
IoDeleteSymbolicLink
ObfReferenceObject
ObfDereferenceObject
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
ZwClose
ObReferenceObjectByHandle
memset
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
KeSetEvent
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlUnwind
KeBugCheckEx

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

fltmgr.sys

FltRegisterFilter
FltStartFiltering
FltUnregisterFilter
FltCancelFileOpen

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 384B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKFsFt64.sys
.sys windows:6 windows x64 arch:x64

8800a239d236c089784b93c9e76eaeaf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:8d:2d:ac:a4:46:65:54:6b:b5:87:97:81:91:a8:bf
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

31-10-2007 00:00

Not After

30-10-2017 23:59

Subject

CN=GeoTrust Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

ad:3e:70:ab:26:8f:7d:34:8f:bf:3e:05:0f:cb:62:ee:76:6b:58:99:6a:f9:aa:cf:ed:2d:bc:59:c5:ac:ef:dd
Signer

Actual PE Digest

ad:3e:70:ab:26:8f:7d:34:8f:bf:3e:05:0f:cb:62:ee:76:6b:58:99:6a:f9:aa:cf:ed:2d:bc:59:c5:ac:ef:dd

Digest Algorithm

sha256

PE Digest Matches

true

80:73:86:a2:95:27:2f:be:7a:0b:4c:94:51:fd:4e:48:cd:00:b6:07
Signer

Actual PE Digest

80:73:86:a2:95:27:2f:be:7a:0b:4c:94:51:fd:4e:48:cd:00:b6:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\worksp~1\engdev~3.0\trunk\bin\free\amd64\TKFsFt64.pdb

Imports

ntoskrnl.exe

ObfReferenceObject
ObfDereferenceObject
KeReleaseSpinLock
IoDeleteSymbolicLink
KeBugCheckEx
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeAcquireSpinLockRaiseToDpc
RtlInitUnicodeString
ExAcquireResourceExclusiveLite
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
KeLeaveCriticalRegion
KeSetEvent
KeInitializeEvent
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExReleaseResourceLite
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltCancelFileOpen
FltStartFiltering

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKIdsVt.sys
.sys windows:6 windows x86 arch:x86

0a7e0ecbd6ccb98296d7618457ac82b6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\en800b~1\worksp~1\trunk\bin\free\i386\TKIdsVt.pdb

Imports

ntoskrnl.exe

ObfDereferenceObject
IoQueueWorkItem
IoAllocateWorkItem
IoFreeWorkItem
strncmp
strncpy
KeReleaseMutex
KeWaitForSingleObject
islower
DbgBreakPoint
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
KeTickCount
KeBugCheckEx
RtlUnwind
PsGetCurrentProcessId
KeInitializeEvent
KeInitializeMutex
DbgPrint
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
memchr
IoGetCurrentProcess
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_strnicmp
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
memcpy
MmMapLockedPagesSpecifyCache
KeReadStateEvent
KeSetEvent
ZwUnloadDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
ExFreePoolWithTag
memset
ExAllocatePoolWithTag
RtlCopyUnicodeString

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpmEngineClose0
FwpsAllocateCloneNetBufferList0
FwpsFreeCloneNetBufferList0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmSubLayerAdd0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpsInjectionHandleCreate0
FwpsCalloutRegister0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsInjectNetworkSendAsync0

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKIdsVt64.sys
.sys windows:6 windows x64 arch:x64

f223952fe7523417e724364b7f82853c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\en800b~1\worksp~1\trunk\bin\free\amd64\TKIdsVt64.pdb

Imports

ntoskrnl.exe

memchr
DbgPrint
KeInitializeMutex
KeInitializeEvent
PsGetCurrentProcessId
ObfDereferenceObject
IoFreeWorkItem
IoAllocateWorkItem
IoQueueWorkItem
strncmp
KeReleaseMutex
strncpy
KeWaitForSingleObject
DbgBreakPoint
islower
IoBuildDeviceIoControlRequest
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
KeBugCheckEx
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
_strnicmp
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeUnicodeString
IoGetCurrentProcess
KeAcquireSpinLockRaiseToDpc
IoAllocateMdl
IoCreateDevice
RtlCopyUnicodeString
IoCreateSymbolicLink
ObReferenceObjectByHandle
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ZwUnloadDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
KeReleaseSpinLock
IoIs32bitProcess
KeSetEvent
IoDeleteDevice
RtlInitUnicodeString
KeReadStateEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
ExAllocatePoolWithTag
MmUnmapLockedPages
__C_specific_handler

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectNetworkSendAsync0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpsCalloutRegister0
FwpmTransactionCommit0
FwpmEngineOpen0
FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineClose0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpsFreeCloneNetBufferList0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpsCalloutUnregisterById0

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKPcFtCb.sys
.sys windows:6 windows x86 arch:x86

08b130c4919fce3888098ed6eebdd31f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a6:90:9c:29:f5:2c:6a:c4:74:42:9e:3c:66:7d:50:1c:ce:a0:46:94
Signer

Actual PE Digest

a6:90:9c:29:f5:2c:6a:c4:74:42:9e:3c:66:7d:50:1c:ce:a0:46:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\hudson\worksp~1\enae3d~1.0\trunk\bin\free\i386\TKPcFtCb.pdb

Imports

ntoskrnl.exe

KeInitializeGuardedMutex
IoCreateSymbolicLink
IoCreateDevice
ObOpenObjectByPointer
KeServiceDescriptorTable
ObfDereferenceObject
ObfReferenceObject
KeStackAttachProcess
PsSetCreateProcessNotifyRoutineEx
PsThreadType
PsProcessType
IoGetCurrentProcess
IoThreadToProcess
ObReferenceObjectByHandle
KeTickCount
RtlInitUnicodeString
IoDeleteDevice
ZwClose
memset
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetVersion
KeSetEvent
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
ZwQuerySystemInformation
_stricmp
KeBugCheckEx
RtlUnwind
DbgPrint
RtlUnicodeToMultiByteN

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKPcFtCb64.sys
.sys windows:6 windows x64 arch:x64

3e4f96ca1877df42bb00ad1fef3003f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\en4822~1\worksp~1\trunk\bin\free\amd64\TKPcFtCb64.pdb

Imports

ntoskrnl.exe

PsProcessType
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
KeInitializeEvent
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForSingleObject
PsGetVersion
PsThreadType
IoCreateSymbolicLink
MmIsAddressValid
IoCreateDevice
DbgPrint
KeReleaseSpinLock
ObfReferenceObject
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
IoThreadToProcess
IoGetCurrentProcess
KeStackAttachProcess
KeBugCheckEx
_stricmp
ExAcquireResourceExclusiveLite
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
KeLeaveCriticalRegion
_wcsnicmp
KeSetEvent
ZwQuerySystemInformation
KeEnterCriticalRegion
ZwQueryValueKey
ExReleaseResourceLite
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
ExInitializeResourceLite
ZwOpenKey
RtlUnicodeToMultiByteN

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKPcFtHk.sys
.sys windows:6 windows x86 arch:x86

67ce3513ca9715ab9163d0e087a177aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\en4822~1\worksp~1\trunk\bin\free\i386\TKPcFtHk.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
ObOpenObjectByPointer
KeServiceDescriptorTable
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeWaitForSingleObject
KeInitializeEvent
DbgPrint
PsGetVersion
PsSetCreateProcessNotifyRoutine
PsThreadType
PsProcessType
ObfDereferenceObject
ObfReferenceObject
KeStackAttachProcess
IoGetCurrentProcess
IoThreadToProcess
ObReferenceObjectByHandle
KeTickCount
KeBugCheckEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoDeleteDevice
ZwClose
memset
IofCompleteRequest
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
memcpy
_wcsnicmp
KeSetEvent
KeReadStateEvent
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
ZwQuerySystemInformation
_stricmp
ZwQueryValueKey
ZwOpenKey
RtlUnwind
RtlUnicodeToMultiByteN

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKPcFtHk64.sys
.sys windows:6 windows x64 arch:x64

52a03f6d8335de264bd39ec87945a503

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:11:91:7d:59:5c:99:ae:4f:18:c6:e1:06:24:07:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2010 00:00

Not After

07-12-2011 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:89:33:47:7f:88:36:12:81:45:3e:05:3b:e1:83:cd:43:47:37:26
Signer

Actual PE Digest

b9:89:33:47:7f:88:36:12:81:45:3e:05:3b:e1:83:cd:43:47:37:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\17440~1.wor\2ada3~1.sou\engdev~3\branches\if2e25~1.01_\bin\free\amd64\TKPcFtHk64.pdb

Imports

ntoskrnl.exe

ExAcquireResourceExclusiveLite
KeClearEvent
KeReadStateEvent
KeLeaveCriticalRegion
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
PsSetCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
IoCreateSymbolicLink
PsGetCurrentProcessId
ObfDereferenceObject
IoCreateDevice
ExInitializeResourceLite
KeReleaseSpinLock
ObfReferenceObject
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
_strnicmp
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlUnicodeStringToAnsiString
IofCompleteRequest
RtlFreeAnsiString
PsGetVersion
KeStackAttachProcess
RtlQueryRegistryValues

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKRgAc2k.sys
.sys windows:6 windows x86 arch:x86

18af0e4bd462a0c6150fb88eab1780f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\enfcbb~1\worksp~1\trunk\bin\free\i386\TKRgAc2k.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
ObReferenceObjectByHandle
ExEventObjectType
ObfDereferenceObject
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
memcpy
ExfInterlockedInsertTailList
IoDeleteSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
strchr
wcschr
KeSetEvent
ZwClose
ZwQueryInformationToken
DbgPrint
ZwWriteFile
ZwCreateFile
KeTickCount
KeBugCheckEx
IoDeleteDevice
RtlCopyUnicodeString
ExFreePoolWithTag
memset
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
PsGetVersion
IoGetCurrentProcess
_strnicmp
strncpy
ObOpenObjectByPointer
PsReferencePrimaryToken
PsReferenceImpersonationToken
KeGetCurrentThread
RtlFreeUnicodeString
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapLockedPages
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKRgAc2k64.sys
.sys windows:6 windows x64 arch:x64

39f5b716dfa8b43761734ba4fb230c44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\enfcbb~1\worksp~1\trunk\bin\free\amd64\TKRgAc2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoIs32bitProcess
KeReleaseSpinLock
ZwUnloadDriver
ExEventObjectType
ObReferenceObjectByHandle
IoCreateSymbolicLink
RtlCopyUnicodeString
IoCreateDevice
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
IofCallDriver
ExFreePoolWithTag
ExInterlockedInsertTailList
wcschr
KeSetEvent
strchr
ZwCreateFile
ZwClose
PsGetCurrentThreadId
PsGetCurrentProcessId
ZwQueryInformationToken
ZwWriteFile
DbgPrint
KeBugCheckEx
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
KeClearEvent
KeReadStateEvent
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
PsReferenceImpersonationToken
PsReferencePrimaryToken
KeInitializeEvent
RtlInitAnsiString
MmBuildMdlForNonPagedPool
IoFreeMdl
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
ExSystemTimeToLocalTime
PsTerminateSystemThread
IoGetCurrentProcess
ExReleaseResourceLite
IofCompleteRequest
KeWaitForSingleObject
RtlTimeToTimeFields
PsGetVersion
ExDeleteResourceLite
ExInitializeResourceLite
ObOpenObjectByPointer
IoAllocateMdl

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKRgFt2k.sys
.sys windows:6 windows x86 arch:x86

763aace061cbd9816365c596e1891de9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:26:5d:2c:f1:b8:c4:91:16:a4:7d:f6:c4:b0:72:86:4a:fd:5d:c4
Signer

Actual PE Digest

61:26:5d:2c:f1:b8:c4:91:16:a4:7d:f6:c4:b0:72:86:4a:fd:5d:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\worksp~1\engdev~4.0\trunk\bin\free\i386\TKRgFt2k.pdb

Imports

ntoskrnl.exe

memset
PsGetCurrentProcessId
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
DbgBreakPoint
MmIsAddressValid
ObQueryNameString
wcsstr
ObReferenceObjectByHandle
ExGetPreviousMode
ObfDereferenceObject
ObfReferenceObject
RtlInitUnicodeString
ZwCreateKey
ZwSetValueKey
ZwDeleteKey
ZwFlushKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwQueryKey
ZwOpenKey
ProbeForRead
MmUserProbeAddress
ProbeForWrite
KeTickCount
IoCreateDevice
IoCreateSymbolicLink
ZwDeleteValueKey
RtlUnwind
DbgPrint
RtlUnicodeToMultiByteN
ZwClose
IofCompleteRequest
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
memcpy
PsGetVersion
_wcsnicmp
IoGetCurrentProcess
_strnicmp
PsLookupProcessByProcessId
strncpy
KeUnstackDetachProcess
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
KeSetEvent
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
MmBuildMdlForNonPagedPool
ZwQuerySystemInformation
_stricmp
MmMapLockedPages
MmCreateMdl
KeServiceDescriptorTable
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKRgFtXp.sys
.sys windows:6 windows x86 arch:x86

386d755c10fcc453c1d7110119ceeec7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\en79e8~1\worksp~1\trunk\bin\free\i386\TKRgFtXp.pdb

Imports

ntoskrnl.exe

memset
KeInitializeMutex
PsGetCurrentProcessId
DbgPrint
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForSingleObject
RtlInitUnicodeString
KeReleaseMutex
ObfDereferenceObject
ObfReferenceObject
CmRegisterCallback
CmUnRegisterCallback
ObQueryNameString
ObReferenceObjectByHandle
DbgBreakPoint
wcsstr
KeTickCount
IoCreateDevice
IoCreateSymbolicLink
KeInitializeEvent
RtlUnwind
RtlUnicodeToMultiByteN
ZwClose
IofCompleteRequest
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
memcpy
_wcsnicmp
IoGetCurrentProcess
_strnicmp
PsLookupProcessByProcessId
strncpy
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
RtlFreeUnicodeString
KeSetEvent
KeReadStateEvent
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
_stricmp
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKRgFtXp64.sys
.sys windows:6 windows x64 arch:x64

bd0a2c61a8c6a84206ead3cad2934d2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\en79e8~1\worksp~1\trunk\bin\free\amd64\TKRgFtXp64.pdb

Imports

ntoskrnl.exe

KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
KeInitializeEvent
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForSingleObject
PsGetVersion
IoCreateSymbolicLink
PsGetCurrentProcessId
MmIsAddressValid
IoCreateDevice
DbgPrint
KeReleaseMutex
KeReleaseSpinLock
ObfReferenceObject
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
ObQueryNameString
wcsstr
DbgBreakPoint
ObReferenceObjectByHandle
CmRegisterCallback
CmUnRegisterCallback
KeBugCheckEx
RtlUnicodeToMultiByteN
_stricmp
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
ExInitializeNPagedLookasideList
PsLookupProcessByProcessId
_wcsnicmp
KeSetEvent
ExpInterlockedPushEntrySList
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySystemInformation
ExpInterlockedPopEntrySList
KeUnstackDetachProcess
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
ZwQueryValueKey
IoGetCurrentProcess
ExReleaseResourceLite
ZwClose
IofCompleteRequest
ExQueryDepthSList
RtlFreeAnsiString
ExInitializeResourceLite
KeStackAttachProcess
ZwOpenKey
__C_specific_handler

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKTool2k.sys
.sys windows:6 windows x86 arch:x86

d9a12bd346b9522bd63c7d74b98a85b2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95
Signer

Actual PE Digest

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\i386\TKTool2k.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoRegisterShutdownNotification
IoRegisterPlugPlayNotification
memcpy
RtlCopyUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
memset
ZwClose
ZwSetInformationFile
ZwQueryInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwOpenKey
KeTickCount
DbgPrint
RtlAnsiCharToUnicodeChar
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
IoDeleteSymbolicLink
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryValueKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwDeleteValueKey
RtlUnwind
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKTool2k64.sys
.sys windows:6 windows x64 arch:x64

2ca3150ee7102c46d43e4d7e618f906b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36
Signer

Actual PE Digest

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\amd64\TKTool2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
IoRegisterShutdownNotification
RtlInitUnicodeString
IoDeleteDevice
ZwUnloadDriver
IoCreateSymbolicLink
RtlCopyUnicodeString
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwClose
ZwQueryInformationFile
ZwOpenKey
KeBugCheckEx
DbgPrint
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySymbolicLinkObject
ZwDeleteValueKey
ZwOpenSymbolicLinkObject
ZwQueryValueKey
IofCompleteRequest
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKToolu.dll
.dll windows:4 windows x86 arch:x86

c19cf5ba61ddde0c28a963f5f3e3161d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:32:28:6b:23:97:7e:a3:43:10:4e:59:10:27:96:13:83:70:6c:aa:eb:ca:9b:ff:3a:65:bd:66:4a:4e:25:44
Signer

Actual PE Digest

3a:32:28:6b:23:97:7e:a3:43:10:4e:59:10:27:96:13:83:70:6c:aa:eb:ca:9b:ff:3a:65:bd:66:4a:4e:25:44

Digest Algorithm

sha256

PE Digest Matches

true

46:18:cb:68:f4:d3:81:e0:ef:39:d9:c5:4d:ef:7f:3c:c3:fd:fe:cd
Signer

Actual PE Digest

46:18:cb:68:f4:d3:81:e0:ef:39:d9:c5:4d:ef:7f:3c:c3:fd:fe:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\project\nos-d\ENGDEV_0607_TKTOOL\trunk\1.0\dll\TKTool\x86\ReleaseU\TKToolU.pdb

Imports

kernel32

SetLastError
GetTickCount
GetVolumeNameForVolumeMountPointW
FreeLibrary
GetCurrentProcess
GetSystemInfo
GetVersionExW
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
FlushFileBuffers
Sleep
IsBadWritePtr
IsBadReadPtr
WriteFile
GetFileAttributesW
GetVolumeInformationW
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
GetVersion
GetDriveTypeW
CloseHandle
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FormatMessageW
LocalFree
CreateFileW
GetSystemDirectoryW
GetLastError
DeviceIoControl
CreateFileA
OutputDebugStringW
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RtlUnwind
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
SetEnvironmentVariableA

user32

IsCharUpperW
wsprintfW
MessageBoxW
PostQuitMessage
IsCharAlphaW

advapi32

DeleteService
QueryServiceStatus
ControlService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
OpenSCManagerW

Exports

Exports

TKToolClose
TKToolDrvFClose
TKToolDrvFindClose
TKToolDrvFindFirstFile
TKToolDrvFindFirstFileEx
TKToolDrvFindNextFile
TKToolDrvFopen
TKToolDrvFopenEx
TKToolDrvFread
TKToolDrvFseek
TKToolDrvFwrite
TKToolDrvGetFileSize
TKToolDrvGetFileSizeEx
TKToolEnumHiddenProcesses
TKToolEnumKernelModeHiddenProcesses
TKToolEnumProcesses
TKToolEnumProcessesEx
TKToolEnumUserModeHiddenProcesses
TKToolFindClose
TKToolFindFirstFile
TKToolFindNextFile
TKToolGetDllVersion
TKToolGetDrvVersion
TKToolInit
TKToolInitCharacterSet
TKToolLoadAtStartUp
TKToolLoadDriver
TKToolLoadDriverEx
TKToolMoveFileAfterReboot
TKToolRcvDeleteFile
TKToolRcvGetModNameFromAddr
TKToolRcvRecoverSdt
TKToolRebootCure
TKToolRecoverKernelModeHiddenProcess
TKToolRemvStoreFinal
TKToolSetCurPathForImagePath
TKToolTerminateProcess
TKToolTerminateThread
TKToolUnloadDriver

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/noska.sys
.sys windows:6 windows x86 arch:x86

848f63553a9a79bfa946f6e3fd4cc6d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxa\npkakl\npkfxa\objfre\i386\noska.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
ZwQuerySystemInformation
RtlUpcaseUnicodeStringToOemString
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
MmIsAddressValid
ObQueryNameString
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlFreeOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/noskp.sys
.sys windows:6 windows x86 arch:x86

0b660f5cc3f1ba0a0f57e8cc78e08b99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\i386\noskp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
memcpy
rand
srand
KeInsertQueue
IofCompleteRequest
KeRemoveQueue
KeReadStateQueue
KeReleaseMutex
KeWaitForSingleObject
KeSetEvent
KeInitializeQueue
KeRundownQueue
KeBugCheck
ObReferenceObjectByHandle
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExDeleteNPagedLookasideList
ZwClose
PsCreateSystemThread
KeInitializeMutex
ExInitializeNPagedLookasideList
ExFreePoolWithTag
IoCreateSymbolicLink
IoCreateDevice
KeInsertQueueDpc
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoDriverObjectType
ObReferenceObjectByName
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
ExAllocatePool
KeDelayExecutionThread
KeTickCount
KeBugCheckEx
memset
PsGetVersion
ExInterlockedPushEntrySList
KeInitializeDpc
ExInterlockedPopEntrySList
MmGetSystemRoutineAddress

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
HalGetInterruptVector

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/noskp64.sys
.sys windows:6 windows x64 arch:x64

9c88f4e55aeb3f2903de2a5331ce4896

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\amd64\noskp64.pdb

Imports

ntoskrnl.exe

KeRemoveQueue
IoDeleteSymbolicLink
ExFreePoolWithTag
KeInitializeMutex
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeDpc
ExpInterlockedPopEntrySList
KeReleaseMutex
PsCreateSystemThread
rand
ExEventObjectType
ZwClose
srand
KeBugCheck
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
KeInitializeQueue
PsGetVersion
IoCreateSymbolicLink
ExAllocatePoolWithTag
ExDeleteNPagedLookasideList
KeInsertQueue
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeReleaseSpinLock
IoDriverObjectType
IoGetDeviceObjectPointer
KeInsertQueueDpc
ObfDereferenceObject
ObReferenceObjectByName
IofCallDriver
KeAcquireSpinLockRaiseToDpc
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
RtlFreeUnicodeString
ZwUnmapViewOfSection
ExAllocatePool
ZwCreateSection
ZwOpenFile
KeBugCheckEx
IoCreateDevice
KeReadStateQueue
MmGetSystemRoutineAddress

hal

KeQueryPerformanceCounter

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/nosku.sys
.sys windows:6 windows x86 arch:x86

618f0d2cb74a4fd908dc9c421a239144

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\i386\nosku.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
IoReleaseRemoveLockEx
IofCallDriver
IoAcquireRemoveLockEx
KeRemoveQueue
KeReadStateQueue
KeSetEvent
KeInitializeQueue
KeRundownQueue
ObReferenceObjectByHandle
ExEventObjectType
DbgPrint
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExAllocatePool
RtlCompareMemory
memcpy
IoDetachDevice
KeInsertQueue
PoStartNextPowerIrp
IoInitializeRemoveLockEx
IoAttachDeviceToDeviceStack
PsGetVersion
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExfInterlockedInsertHeadList
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwQuerySystemInformation
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
_vsnprintf
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByName
IoDriverObjectType
MmIsAddressValid
KeTickCount
KeBugCheckEx
srand
rand
ExAllocatePoolWithTag
ExFreePoolWithTag
memset
ExInterlockedPushEntrySList
PoCallDriver
ExInterlockedPopEntrySList
RtlUnwind

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter

usbd.sys

_USBD_ParseConfigurationDescriptorEx@28

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/nosku64.sys
.sys windows:6 windows x64 arch:x64

8550e6c402121795663b7087da3991d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\amd64\nosku64.pdb

Imports

ntoskrnl.exe

IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
ExpInterlockedPopEntrySList
IoDetachDevice
ExAllocatePool
rand
ExEventObjectType
PoStartNextPowerIrp
srand
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
KeInitializeQueue
PoCallDriver
PsGetVersion
KeRemoveQueue
IoCreateSymbolicLink
IoInitializeRemoveLockEx
IoCreateDevice
DbgPrint
ExDeleteNPagedLookasideList
IofCallDriver
KeInsertQueue
KeAcquireSpinLockRaiseToDpc
ExInterlockedInsertHeadList
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
RtlFreeUnicodeString
ZwUnmapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlUnicodeStringToAnsiString
IoDriverObjectType
_vsnprintf
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
KeBugCheckEx
IoAcquireRemoveLockEx
ExAllocatePoolWithTag
RtlCompareMemory
KeReadStateQueue
_local_unwind
RtlUnwindEx

hal

KeQueryPerformanceCounter

usbd.sys

USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/np_ck32s.sys
.sys windows:6 windows x86 arch:x86

2429bd661b999e0ddeaef9e42eff057e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:10:be:cc:d3:d7:61:1f:be:cc:3d:e4:4d:4b:b7:64:0d:6d:4a:31
Signer

Actual PE Digest

53:10:be:cc:d3:d7:61:1f:be:cc:3d:e4:4d:4b:b7:64:0d:6d:4a:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\_crypto\npcrypto_src\npcrypto\np_ck32s\objfre_w2k_x86\i386\np_ck32s.pdb

Imports

ntoskrnl.exe

memset
ZwQuerySystemInformation
ZwClose
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsTerminateSystemThread
KeDelayExecutionThread
KdDebuggerEnabled
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
PsCreateSystemThread
ExAllocatePoolWithTag
DbgPrint
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
memcpy
KeQuerySystemTime
PsGetCurrentThreadId
PsGetCurrentProcessId
KeTickCount
KeBugCheckEx
MmIsAddressValid
ExFreePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

_NpDecPK@32
_NpDecSymk@28
_NpDestroy@4
_NpEncPK@32
_NpEncSymk@28
_NpGetState@8
_NpHMAC@32
_NpHash@24
_NpInit@4
_NpPKGen@16
_NpRandom@12
_NpSKGen@12
_NpSelfTest@4
_NpSignPK@24
_NpVerifyPK@24

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 393B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 896B - Virtual size: 802B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 768B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/np_ck64s.sys
.sys windows:6 windows x64 arch:x64

a91fd37ae6dce75fc02368dc80bb0bcb

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:9a:26:bf:b8:00:e9:9f:c6:ca:00:4e:42:f1:a9:0b:f5:b1:22:98
Signer

Actual PE Digest

17:9a:26:bf:b8:00:e9:9f:c6:ca:00:4e:42:f1:a9:0b:f5:b1:22:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\_crypto\npcrypto_src\npcrypto\np_ck64s\objfre_wnet_amd64\amd64\np_ck64s.pdb

Imports

ntoskrnl.exe

RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
PsCreateSystemThread
KdDebuggerEnabled
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExFreePoolWithTag
ObfDereferenceObject
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
DbgPrint
PsGetCurrentThreadId
PsGetCurrentProcessId
KeBugCheckEx
MmIsAddressValid
ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

NpDecPK
NpDecSymk
NpDestroy
NpEncPK
NpEncSymk
NpGetState
NpHMAC
NpHash
NpInit
NpPKGen
NpRandom
NpSKGen
NpSelfTest
NpSignPK
NpVerifyPK

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/npkakl.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10-11-2014 00:00

Not After

10-11-2015 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f
Signer

Actual PE Digest

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkeycrypt\drivers\5.0\nt\npkakl\npkakl\objfre\i386\npkakl.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/npkfxa.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10-11-2014 00:00

Not After

10-11-2015 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a
Signer

Actual PE Digest

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkfx65\sys\npkfxa\npkakl\npkfxa\objfre\i386\npkfxa.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkfwflt.sys
.sys windows:5 windows x86 arch:x86

9d97e8586178e7df479db7cdd3c6831d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:37:04:4b:6d:a5:69:f4:65:77:47:12:e2:de:a7:84:41:29:6b:93
Signer

Actual PE Digest

9a:37:04:4b:6d:a5:69:f4:65:77:47:12:e2:de:a7:84:41:29:6b:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\PROJEC~2\EN8FAA~1\branches\IF1_RB~3.01_\bin\free\i386\tkfwflt.pdb

Imports

ntoskrnl.exe

KeGetCurrentThread
ZwClose
islower
strncmp
RtlInitString
_wcsnicmp
KeWaitForSingleObject
_stricmp
MmIsAddressValid
MmBuildMdlForNonPagedPool
IoAllocateMdl
RtlCompareMemory
IoFreeMdl
IofCallDriver
MmMapLockedPages
KeSetEvent
KeReadStateEvent
ObReferenceObjectByHandle
PsCreateSystemThread
PsTerminateSystemThread
KeSetPriorityThread
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
MmProbeAndLockPages
IoAllocateIrp
IoGetRelatedDeviceObject
IoFreeIrp
MmUnlockPages
IoGetCurrentProcess
_strnicmp
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
ExAllocatePoolWithTag
memmove
RtlQueryRegistryValues
ExFreePool
PsGetVersion
PsGetCurrentProcessId
ObfReferenceObject
ObfDereferenceObject
KeInitializeSpinLock
KeInitializeEvent
IoCreateDevice
IoCreateSymbolicLink
MmMapLockedPagesSpecifyCache
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
IoRegisterShutdownNotification
ZwQuerySystemInformation
DbgPrint

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

ndis.sys

NdisAllocateMemory
NdisAllocatePacketPool
NdisAllocateBufferPool
NdisFreePacketPool
NdisCloseAdapter
NdisAllocateMemoryWithTag
NdisRegisterProtocol
NdisUnchainBufferAtFront
NdisAllocatePacket
NdisAllocateBuffer
NdisFreeMemory
NdisFreePacket
NdisOpenAdapter

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkfwfltU.dll
.dll windows:4 windows x86 arch:x86

705ded5385fdf03f707bae3ec273afa7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:3d:21:b4:cf:3d:af:15:22:6e:b1:2e:f2:3c:54:54:a8:d7:06:28
Signer

Actual PE Digest

a4:3d:21:b4:cf:3d:af:15:22:6e:b1:2e:f2:3c:54:54:a8:d7:06:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\TKFWFLT\branches\IF1_RB-2012.01.05.01\Dll\tkfwflt\ReleaseU\tkfwfltU_dll.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

GetSystemInfo
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetSystemDirectoryW
GetVersionExW
GetCurrentProcessId
ReleaseMutex
GetCurrentProcess
InterlockedIncrement
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
CompareStringA
CreateFileA
GetTimeZoneInformation
OutputDebugStringW
FormatMessageW
LocalFree
GetTickCount
Sleep
SetLastError
GetVersion
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
CompareStringW
CreateMutexW
GetModuleHandleA
GetLocaleInfoW
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle

user32

wsprintfW
MessageBoxW

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
RegOpenKeyExW

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Exports

Exports

TKFWFLTCloseDrv
TKFWFLTGetVersion
TKFWFLTInitDrv
TKFWFLTIsDrvLoaded
TKFWFLTIsDrvReady
TKFWFLTLoadAtStartUp
TKFWFLTModPktHdr
TKFWFLTSetAppReady
TKFWFLTSetNetworkStop
TKFWFVInstallNLoadDrv
TKFWFVInstallNLoadDrvEx
TKFWFVIsDrvLoaded
TKFWFVUninstallNUnLoadDrv
TKFWFVUninstallNUnLoadDrvEx

Sections

.text
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 265B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkfwvt.sys
.sys windows:6 windows x86 arch:x86

11888564d7c6364446e49e59922c633c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\engdev~4\worksp~1\trunk\bin\free\i386\tkfwvt.pdb

Imports

ntoskrnl.exe

KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsCreateSystemThread
PsGetCurrentThreadId
KeClearEvent
KeBugCheckEx
RtlUnwind
ZwOpenKey
ZwQueryValueKey
strncpy
KeQuerySystemTime
ExSystemTimeToLocalTime
RtlTimeToTimeFields
ExAllocatePoolWithTag
RtlCompareMemory
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
PsSetCreateProcessNotifyRoutine
IoRegisterShutdownNotification
ZwClose
MmIsAddressValid
KeReleaseMutex
DbgBreakPoint
memchr
_allmul
_alldiv
KeTickCount
KeQueryTimeIncrement
DbgPrint
_strnicmp
PsGetVersion
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeMutex
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
KeInitializeEvent
PsGetCurrentProcessId
KeReadStateEvent
ZwUnloadDriver
memcpy
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeDelayExecutionThread
KeSetEvent
KeWaitForSingleObject
ObfDereferenceObject
memset
RtlCopyUnicodeString
ObQueryNameString
IoGetCurrentProcess
PsLookupProcessByProcessId
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnicodeToMultiByteN

hal

KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisFSendNetBufferListsComplete
NdisFSendNetBufferLists

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpmEngineClose0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsCalloutRegister0
FwpsFreeCloneNetBufferList0
FwpsAllocateCloneNetBufferList0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleCreate0

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkfwvt64.sys
.sys windows:6 windows x64 arch:x64

30f12997a2cd083809f9cf859612fd4b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\engdev~4\worksp~1\trunk\bin\free\amd64\tkfwvt64.pdb

Imports

ntoskrnl.exe

ZwQueryValueKey
ZwOpenKey
KeReleaseSpinLockFromDpcLevel
KeAcquireSpinLockAtDpcLevel
KeClearEvent
RtlCompareMemory
PsCreateSystemThread
PsGetCurrentThreadId
KeBugCheckEx
RtlTimeToTimeFields
ExSystemTimeToLocalTime
strncpy
ExAllocatePoolWithTag
IofCallDriver
MmIsAddressValid
ZwClose
IoGetDeviceObjectPointer
PsSetCreateProcessNotifyRoutine
IoBuildDeviceIoControlRequest
KeReleaseMutex
MmUnmapLockedPages
DbgPrint
PsGetVersion
RtlFreeAnsiString
KeQueryTimeIncrement
DbgBreakPoint
RtlUnicodeStringToAnsiString
memchr
_strnicmp
KeAcquireSpinLockRaiseToDpc
IoAllocateMdl
IoCreateDevice
ObfDereferenceObject
RtlCopyUnicodeString
PsGetCurrentProcessId
IoCreateSymbolicLink
KeWaitForSingleObject
ObReferenceObjectByHandle
IofCompleteRequest
MmMapLockedPagesSpecifyCache
KeDelayExecutionThread
ZwUnloadDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
KeAcquireInStackQueuedSpinLock
KeReleaseSpinLock
IoIs32bitProcess
KeInitializeEvent
KeSetEvent
IoDeleteDevice
RtlInitUnicodeString
KeReleaseInStackQueuedSpinLock
KeInitializeMutex
KeReadStateEvent
IoRegisterShutdownNotification
ExFreePoolWithTag
IoDeleteSymbolicLink
ProbeForRead
RtlAnsiStringToUnicodeString
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitAnsiString
ZwQuerySystemInformation
KeUnstackDetachProcess
RtlFreeUnicodeString
ObQueryNameString
IoGetCurrentProcess
KeStackAttachProcess
RtlUnicodeToMultiByteN
__C_specific_handler

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisFSendNetBufferListsComplete
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisFSendNetBufferLists
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisMSleep

fwpkclnt.sys

FwpmEngineClose0
FwpmTransactionBegin0
FwpsInjectTransportSendAsync0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpsAllocateCloneNetBufferList0
FwpmCalloutAdd0
FwpsInjectTransportReceiveAsync0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleDestroy0
FwpsFreeCloneNetBufferList0
FwpsCalloutUnregisterById0

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkids.sys
.sys windows:6 windows x86 arch:x86

46956ab5c9fcc3e59373f44c449e4a43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:11:c6:eb:e4:f5:e1:34:2c:a9:12:1b:1c:d9:6d:4e:dc:9f:ed:4d
Signer

Actual PE Digest

52:11:c6:eb:e4:f5:e1:34:2c:a9:12:1b:1c:d9:6d:4e:dc:9f:ed:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\projec~1\en800b~1\branches\if1_rb~3.01_\bin\free\i386\tkids.pdb

Imports

ntoskrnl.exe

MmMapLockedPagesSpecifyCache
memcpy
memset
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
KeSetEvent
KeReadStateEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmUnmapLockedPages
ObReferenceObjectByHandle
KeInitializeMutex
KeInitializeEvent
PsGetCurrentProcessId
ObfDereferenceObject
_strnicmp
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
PsGetVersion
IofCompleteRequest
islower
memchr
strncmp
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
strncpy
KeReleaseMutex
KeWaitForSingleObject
RtlQueryRegistryValues
memmove
ZwClose
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
RtlInitUnicodeString
IoDeleteSymbolicLink
IoRegisterShutdownNotification
IoDeleteDevice
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlCopyUnicodeString
KeTickCount
MmIsAddressValid
ObQueryNameString
IoGetCurrentProcess
PsLookupProcessByProcessId
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnwind
DbgPrint
RtlUnicodeToMultiByteN

hal

KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkidsxU.dll
.dll windows:4 windows x86 arch:x86

95b858b1f54e093e088ccc59c7be20fa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:c3:ea:06:e2:c3:73:67:08:63:ae:69:5a:52:bb:91:84:2e:9b:e3
Signer

Actual PE Digest

08:c3:ea:06:e2:c3:73:67:08:63:ae:69:5a:52:bb:91:84:2e:9b:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\TKIDS\branches\IF1_RB-2012.01.09.01\Dll\tkidsx\ReleaseU\tkidsxU.pdb

Imports

setupapi

SetupCopyOEMInfW

ws2_32

ntohl
ntohs

kernel32

GetTickCount
LocalFree
FormatMessageW
FreeLibrary
GetProcAddress
LoadLibraryW
OutputDebugStringW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetSystemDirectoryW
SetEvent
TerminateThread
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateEventW
GetCurrentProcess
Sleep
VirtualAlloc
DuplicateHandle
OpenProcess
ReadProcessMemory
LocalAlloc
HeapFree
GetProcessHeap
InterlockedDecrement
SleepEx
InterlockedIncrement
GetVersionExW
GetSystemInfo
GetModuleHandleW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetLastError
GetVersion
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
CreateFileA
GetTimeZoneInformation
CompareStringA
CompareStringW
VirtualFree
EnterCriticalSection
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
SetEnvironmentVariableA
LeaveCriticalSection
GetModuleHandleA
ExitProcess
HeapReAlloc
GetFileAttributesW
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
GetCommandLineA
GetVersionExA
SetConsoleCtrlHandler
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
FatalAppExitA
HeapDestroy
HeapCreate
TerminateProcess
IsDebuggerPresent
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
HeapSize
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
LCMapStringA

user32

wsprintfW
MessageBoxW
PostThreadMessageW
SendMessageW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
OpenProcessToken

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize

Exports

Exports

TKIDSBuildIDSRule
TKIDSCallbackMsgComplete
TKIDSCanDoDrvUnload
TKIDSCloseDrv
TKIDSCloseDrvEx
TKIDSDelAPValue
TKIDSDelAllAPValue
TKIDSDelAllAllowPId
TKIDSDelAllAntiDDosIp
TKIDSDelAllBlockPId
TKIDSDelAllIDSRules
TKIDSDelAllNoLogPId
TKIDSDelAllPCSiteAllInfos
TKIDSDelAllPCSiteInfo
TKIDSDelAllowPId
TKIDSDelAntiDDosIp
TKIDSDelBlockPId
TKIDSDelNoLogPId
TKIDSDelPCSiteInfo
TKIDSDeleteAllAntiDDosExceptProcess
TKIDSDeleteAntiDDosExceptProcess
TKIDSGetVersion
TKIDSInitDrv
TKIDSInitDrvEx
TKIDSInsAPValue
TKIDSInsAllowPId
TKIDSInsAntiDDosIp
TKIDSInsBlockPId
TKIDSInsIDSRule
TKIDSInsNoLogPId
TKIDSInsPCSiteInfo
TKIDSInsertAntiDDosExceptProcess
TKIDSInstallDrv
TKIDSRegCallbackFunc
TKIDSRegThreadCallbackMsg
TKIDSReghWndCallbackMsg
TKIDSRelAntiDDosIpHeaderMod
TKIDSReleaseAntiDDosInfected
TKIDSSendPkt
TKIDSSetAPAuthResult
TKIDSSetAPPolicyInfo
TKIDSSetAPUse
TKIDSSetAntiDDosIpHeaderMod
TKIDSSetAppReady
TKIDSSetExtraPolicy
TKIDSSetIDSPause
TKIDSSetPCAuthResult
TKIDSSetPCPolicyInfo
TKIDSSetPCUse
TKIDSUninstallDrv

Sections

.text
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tknetcfg.exe
.exe windows:4 windows x86 arch:x86

cffbd3ad773e8cc9d466bf9b0e5392d6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

69:b9:b1:8d:6c:dd:19:21:9d:d1:a0:5a:49:d6:8d:97:4c:75:db:b2
Signer

Actual PE Digest

69:b9:b1:8d:6c:dd:19:21:9d:d1:a0:5a:49:d6:8d:97:4c:75:db:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\SVN\ENGDEV_0803_TKFWFLT\branches\IF1_RB-2010.03.16.01\App\TKNetCfg\Release\Win32\tknetcfg.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

SetLastError
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
CopyFileW
DeleteFileW
OutputDebugStringW
GetLastError
FormatMessageW
LocalFree
CloseHandle
CreateFileA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
HeapSize

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/tknetcfg64.exe
.exe windows:4 windows x64 arch:x64

faa7f8783341e73f56ccaa861494179f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

68:32:a6:ab:eb:de:77:c3:63:55:72:23:46:23:89:35:45:d2:1f:c2
Signer

Actual PE Digest

68:32:a6:ab:eb:de:77:c3:63:55:72:23:46:23:89:35:45:d2:1f:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\SVN\ENGDEV_0803_TKFWFLT\branches\IF1_RB-2010.03.16.01\App\TKNetCfg\x64\Release\tknetcfg64.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

FlsSetValue
GetSystemDirectoryW
GetCurrentDirectoryW
CopyFileW
DeleteFileW
GetWindowsDirectoryW
OutputDebugStringW
GetLastError
FormatMessageW
LocalFree
CloseHandle
CreateFileA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FlsGetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapReAlloc
FlushFileBuffers
HeapSize

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$WINDIR/Downloaded Program Files/nosxplatform.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

e46748afe32fa180042b0bd6b303bb05

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:63:61:88:be:15:b9:21:27:24:ae:4b:69:9f:ab:37:a5:b2:7e:b9:ce:18:4c:35:cd:c9:96:fc:ad:d5:f6:73
Signer

Actual PE Digest

09:63:61:88:be:15:b9:21:27:24:ae:4b:69:9f:ab:37:a5:b2:7e:b9:ce:18:4c:35:cd:c9:96:fc:ad:d5:f6:73

Digest Algorithm

sha256

PE Digest Matches

true

c0:94:9b:ec:43:e4:bc:62:49:89:97:70:ad:3d:0a:5d:2f:82:f2:3f
Signer

Actual PE Digest

c0:94:9b:ec:43:e4:bc:62:49:89:97:70:ad:3d:0a:5d:2f:82:f2:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\nossdk\nosxplatform\build\bin\release\nosxplatform.pdb

Imports

psapi

GetModuleBaseNameW

shlwapi

PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

kernel32

SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
RtlUnwind
ExitProcess
RaiseException
HeapSize
VirtualProtect
VirtualAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
IsBadReadPtr
GetCommandLineA
CreateThread
ExitThread
GetProfileIntW
GetFileTime
GetFileAttributesW
FindResourceExW
lstrlenA
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GlobalFlags
WritePrivateProfileStringW
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalSize
GlobalFree
IsDBCSLeadByte
GlobalUnlock
MulDiv
FreeResource
GlobalFindAtomW
LoadLibraryA
GetVersionExA
GlobalAddAtomW
InterlockedIncrement
lstrlenW
CompareStringW
InterlockedDecrement
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
LoadLibraryExW
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
CopyFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseMutex
OpenMutexW
CreateMutexW
GetVersion
GetSystemInfo
VerifyVersionInfoW
VerSetConditionMask
GetLocalTime
FormatMessageW
OutputDebugStringW
HeapFree
GetProcessHeap
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
MoveFileW
SetFilePointer
GetFileSize
DeleteFileW
SetFileAttributesW
WriteFile
CreateFileW
LockResource
SizeofResource
LoadResource
FindResourceW
FindFirstFileW
FindClose
ProcessIdToSessionId
TerminateProcess
CreateProcessW
ReadFile
GetCurrentProcess
GetCurrentProcessId
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetLastError
LocalAlloc
LocalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
GetUserDefaultLCID
GetLastError
EnumUILanguagesW
GetLocaleInfoW
GetUserDefaultUILanguage
GetModuleHandleW
GetModuleHandleA
CreateDirectoryW
VirtualQuery
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
TerminateThread
WaitForSingleObject
SetEvent
CreateEventW
CloseHandle
GlobalMemoryStatusEx
QueryPerformanceFrequency
IsValidCodePage
GetSystemTime

user32

SetRectEmpty
LoadCursorW
SetCapture
ReleaseCapture
GetMenuStringW
AppendMenuW
InsertMenuW
RemoveMenu
RegisterClipboardFormatW
SetRect
GetDesktopWindow
InvalidateRect
ShowWindow
DrawEdge
SetParent
IsDialogMessageW
SetWindowTextW
MoveWindow
SetWindowRgn
InflateRect
IsRectEmpty
CreateMenu
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
DrawTextExW
DrawTextW
TabbedTextOutW
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
SetFocus
GetWindowTextW
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetClientRect
GetMenu
GetSubMenu
EnumChildWindows
LockWindowUpdate
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
UnregisterClassW
GetSysColorBrush
DestroyIcon
CharUpperW
GetTabbedTextExtentA
GetDialogBaseUnits
GetDCEx
GrayStringW
UnregisterClassA
GetParent
EnableWindow
FillRect
MessageBoxW
IsWindowVisible
GetWindow
GetWindowLongW
GetWindowThreadProcessId
GetSystemMetrics
PostQuitMessage
PostMessageW
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuW
SendMessageW
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
UnhookWindowsHookEx
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExW

gdi32

UnrealizeObject
Rectangle
EnumFontFamiliesExW
GetTextMetricsW
GetTextAlign
PatBlt
SetRectRgn
GetTextExtentPoint32W
CreateFontIndirectW
CombineRgn
CreateDCW
CopyMetaFileW
Ellipse
DeleteMetaFile
CloseMetaFile
CreateMetaFileW
LPtoDP
CreateRectRgnIndirect
CreateSolidBrush
CreatePen
GetDeviceCaps
CreatePatternBrush
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
GetObjectW
SaveDC
RestoreDC
SetBkMode
SetROP2
SetMapMode
MoveToEx
DeleteObject
SelectClipRgn
CreateRectRgn
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetCurrentPositionEx
GetStockObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

GetSecurityDescriptorDacl
GetKernelObjectSecurity
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegSetValueW
RegQueryValueW
RegEnumKeyW
RegCreateKeyExW
ConvertSidToStringSidW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyW
RegCreateKeyW
RegQueryValueExW
RegDeleteKeyW
InitializeSecurityDescriptor
RegOpenKeyExW
CreateProcessAsUserW
SetKernelObjectSecurity
SetSecurityDescriptorDacl
MakeAbsoluteSD
SetEntriesInAclW
AdjustTokenPrivileges
BuildExplicitAccessWithNameW
LookupPrivilegeValueW
SetTokenInformation
GetTokenInformation
LookupAccountSidW
GetSidIdentifierAuthority
GetSidSubAuthority
IsValidSid
GetSidSubAuthorityCount
OpenProcessToken
DuplicateTokenEx
GetUserNameW

shell32

ExtractIconW
ShellExecuteExW
SHGetFolderPathW

ole32

ReleaseStgMedium
CreateDataAdviseHolder
CreateDataCache
OleSaveToStream
OleDestroyMenuDescriptor
CoTaskMemFree
CoDisconnectObject
CoCreateInstance
ReadClassStm
CreateStreamOnHGlobal
OleLoadFromStream
OleCreateMenuDescriptor
CoTaskMemAlloc
CreateOleAdviseHolder
StringFromCLSID
CoRevokeClassObject
CoRegisterClassObject
CoCreateGuid
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReadFmtUserTypeStg
StringFromGUID2
OleDuplicateData

oleaut32

SysFreeString
SysStringByteLen
SysStringLen
VariantClear
VariantChangeType
VariantInit
OleCreatePropertyFrame
SysAllocString
OleCreateFontIndirect
VariantCopy
LoadTypeLi
OleLoadPicture
OleCreatePictureIndirect
RegisterTypeLi
SysAllocStringLen
LoadRegTypeLi

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

userenv

DestroyEnvironmentBlock

crypt32

CryptMsgGetParam
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CertFindCertificateInStore
CryptQueryObject

wintrust

WinVerifyTrust

wininet

FtpGetFileSize
HttpSendRequestW
HttpQueryInfoW
FtpOpenFileW
InternetSetOptionW
InternetReadFile
InternetQueryDataAvailable
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetConnectW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 464KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
7z.dll
.dll windows:4 windows x86 arch:x86

6121a49841bf6f5b3700c1ebbb28be41

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CharPrevExA
CharPrevA
CharNextA
CharLowerW
CharLowerA
CharUpperW
CharUpperA

oleaut32

SysFreeString
SysAllocStringByteLen
VariantCopy
VariantClear
SysAllocString

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
strcmp
memset
memcmp
_purecall
memmove
memcpy
__CxxFrameHandler
free
_CxxThrowException
malloc

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
CreateEventA
WaitForSingleObject
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FileTimeToLocalFileTime
DeleteCriticalSection
LocalFileTimeToFileTime
GetVersionExA
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleA
GetProcAddress
GetSystemInfo
CompareFileTime
WriteFile
ReadFile
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CloseHandle
SetFileAttributesA
DeleteFileA
GetTempPathA
GetTempFileNameA
CreateFileA

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bsc20/npacr_32.dll
.dll windows:5 windows x86 arch:x86

134e4b91b6ab6bc4db4559bb43ae4bf1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f0:89:fd:d9:43:b1:fb:56:e9:e0:f3:68:76:20:6a:bd:85:c4:52:bb:bf:c0:75:a1:47:03:2c:0b:62:2e:1c:21
Signer

Actual PE Digest

f0:89:fd:d9:43:b1:fb:56:e9:e0:f3:68:76:20:6a:bd:85:c4:52:bb:bf:c0:75:a1:47:03:2c:0b:62:2e:1c:21

Digest Algorithm

sha256

PE Digest Matches

true

00:19:6d:36:3f:b2:60:cd:16:86:38:b8:ad:9f:4f:e9:2b:86:2b:fd
Signer

Actual PE Digest

00:19:6d:36:3f:b2:60:cd:16:86:38:b8:ad:9f:4f:e9:2b:86:2b:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Build\ASC20\Acs20pkg\Dll\ixNpacr\Release\npacr_32.pdb

Imports

kernel32

InterlockedDecrement
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
EncodePointer
DecodePointer
InterlockedCompareExchange
MultiByteToWideChar
GetLocaleInfoW
GetStringTypeW
InterlockedIncrement
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcess
GetModuleFileNameW
CreateEventW
CreateFileW
WaitNamedPipeW
FlushFileBuffers
DisconnectNamedPipe
ReadFile
WaitForSingleObject
GetOverlappedResult
ResetEvent
WriteFile
GetCurrentThreadId
TerminateProcess
LoadLibraryA
VirtualQuery
SetLastError
GetModuleHandleA
VirtualAlloc
ResumeThread
FlushInstructionCache
GetThreadContext
SetThreadContext
SuspendThread
HeapFree
HeapAlloc
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
RaiseException
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringW
HeapReAlloc
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
IsProcessorFeaturePresent
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointer
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetProcessHeap
CloseHandle
TerminateThread
GetExitCodeThread
FreeLibrary
LoadLibraryW
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentProcessId
VirtualProtect
GetLastError
GetModuleHandleW
GetProcAddress

user32

GetClientRect
IntersectRect
LoadImageW
GetDC
ReleaseDC
GetDesktopWindow
FindWindowW
GetParent
GetWindow
GetWindowThreadProcessId

gdi32

DeleteObject
DeleteDC
GetObjectW
SelectObject
CreateCompatibleDC
GetClipBox
GetObjectType

ole32

CoUninitialize
CoInitialize

advapi32

SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARE_N
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bsc20/npacr_64.dll
.dll windows:5 windows x64 arch:x64

a3f4b91618b071889a3b007add5ddb7f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:70:0b:d7:33:13:24:0e:74:fd:63:bf:94:20:bb:d2:0d:b7:98:14:11:11:bb:90:52:a0:c4:4d:30:fc:24:f8
Signer

Actual PE Digest

1f:70:0b:d7:33:13:24:0e:74:fd:63:bf:94:20:bb:d2:0d:b7:98:14:11:11:bb:90:52:a0:c4:4d:30:fc:24:f8

Digest Algorithm

sha256

PE Digest Matches

true

37:08:a9:20:e6:7f:76:76:57:4b:73:86:c6:03:de:3e:34:b7:8b:a5
Signer

Actual PE Digest

37:08:a9:20:e6:7f:76:76:57:4b:73:86:c6:03:de:3e:34:b7:8b:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Build\ASC20\Acs20pkg\Dll\ixNpacr\Release\npacr_64.pdb

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
GetLocaleInfoW
GetStringTypeW
Sleep
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcess
GetModuleFileNameW
CreateEventW
CreateFileW
WaitNamedPipeW
FlushFileBuffers
DisconnectNamedPipe
ReadFile
WaitForSingleObject
GetOverlappedResult
ResetEvent
WriteFile
GetCurrentThreadId
TerminateProcess
LoadLibraryA
VirtualQuery
SetLastError
GetModuleHandleA
VirtualAlloc
ResumeThread
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
HeapFree
HeapAlloc
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
LCMapStringW
GetCPInfo
GetDateFormatA
GetTimeFormatA
CompareStringW
HeapReAlloc
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
HeapSize
FlsGetValue
FlsFree
FlsAlloc
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointer
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetProcessHeap
CloseHandle
TerminateThread
GetExitCodeThread
FreeLibrary
LoadLibraryW
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentProcessId
VirtualProtect
GetLastError
GetModuleHandleW
GetProcAddress

user32

GetClientRect
IntersectRect
LoadImageW
GetDC
ReleaseDC
GetDesktopWindow
FindWindowW
GetParent
GetWindow
GetWindowThreadProcessId

gdi32

DeleteObject
DeleteDC
GetObjectW
SelectObject
CreateCompatibleDC
GetClipBox
GetObjectType

ole32

CoUninitialize
CoInitialize

advapi32

SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHARE_N
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bsc20/npamgr_32.exe
.exe windows:5 windows x86 arch:x86

7b502ebc552937602727d4e9fcb444d3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:22:c4:04:c4:96:a6:93:b7:70:52:c8:fe:fa:87:54:e1:2f:f1:cb:5f:7f:94:5f:21:a9:80:4a:f0:34:ca:eb
Signer

Actual PE Digest

16:22:c4:04:c4:96:a6:93:b7:70:52:c8:fe:fa:87:54:e1:2f:f1:cb:5f:7f:94:5f:21:a9:80:4a:f0:34:ca:eb

Digest Algorithm

sha256

PE Digest Matches

true

c1:89:3b:68:04:6c:da:c3:0a:ed:4e:74:19:2a:81:a9:d9:53:01:62
Signer

Actual PE Digest

c1:89:3b:68:04:6c:da:c3:0a:ed:4e:74:19:2a:81:a9:d9:53:01:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Build\Source\ASC20\Exe\ixNpamgr\Release\npamgr_32.pdb

Imports

kernel32

TerminateProcess
GetExitCodeProcess
FreeLibrary
LoadLibraryW
GetModuleFileNameW
ResetEvent
GetCurrentProcessId
SetEvent
GetLastError
Process32NextW
Process32FirstW
ReleaseMutex
ProcessIdToSessionId
GetProcessHeap
CreateMutexW
OpenMutexW
CreateEventW
DeviceIoControl
CreateFileW
CreateRemoteThread
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
CloseHandle
VirtualFreeEx
GetModuleHandleW
GetProcAddress
WriteProcessMemory
VirtualAllocEx
GetProcessHandleCount
Sleep
OpenProcess
TerminateThread
GetExitCodeThread
WaitForSingleObject
CreateThread
SetLastError
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
EncodePointer
DecodePointer
InterlockedCompareExchange
MultiByteToWideChar
GetLocaleInfoW
GetStringTypeW
FormatMessageW
LocalFree
GetCurrentProcess
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleExW
CreateNamedPipeW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetCurrentThreadId
GetQueuedCompletionStatus
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
WriteFile
CreateSemaphoreW
ReleaseSemaphore
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapFree
HeapAlloc
RtlUnwind
RaiseException
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringW
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA

user32

UnregisterHotKey
SetClipboardViewer
OpenClipboard
RegisterHotKey
CallWindowProcA
CallWindowProcW
SetPropW
SetWindowLongA
GetClassLongA
SetWindowLongW
GetClassLongW
IsWindowUnicode
DispatchMessageW
TranslateMessage
GetMessageW
ShowWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostQuitMessage
SendMessageW
GetAsyncKeyState
ChangeClipboardChain
CloseClipboard
EmptyClipboard

gdi32

GetStockObject

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
StartServiceW
CreateServiceW
DeleteService
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW

ole32

StringFromGUID2
CoCreateGuid

Sections

.text
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARE_N
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bsc20/npamgr_64.exe
.exe windows:5 windows x64 arch:x64

5cab3c093f9e92e818b9472ac72c36b9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:69:19:c8:8f:5a:f3:59:ef:3f:80:f5:f6:c8:93:71:2f:bc:7f:bc:65:47:2d:da:2e:91:05:94:11:b3:aa:3e
Signer

Actual PE Digest

68:69:19:c8:8f:5a:f3:59:ef:3f:80:f5:f6:c8:93:71:2f:bc:7f:bc:65:47:2d:da:2e:91:05:94:11:b3:aa:3e

Digest Algorithm

sha256

PE Digest Matches

true

2f:00:f6:9a:ed:57:ba:15:93:e9:41:70:e3:3b:4d:54:56:9a:3c:68
Signer

Actual PE Digest

2f:00:f6:9a:ed:57:ba:15:93:e9:41:70:e3:3b:4d:54:56:9a:3c:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Build\Source\ASC20\Exe\ixNpamgr\Release\npamgr_64.pdb

Imports

kernel32

GetStringTypeW
GetLocaleInfoW
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TerminateProcess
GetExitCodeProcess
FreeLibrary
LoadLibraryW
GetModuleFileNameW
ProcessIdToSessionId
ResetEvent
GetCurrentProcessId
GetLastError
Process32NextW
Process32FirstW
ReleaseMutex
CreateMutexW
OpenMutexW
CreateEventW
DeviceIoControl
CreateFileW
CreateRemoteThread
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
CloseHandle
VirtualFreeEx
GetModuleHandleW
GetProcAddress
WriteProcessMemory
VirtualAllocEx
SetEvent
GetProcessHandleCount
Sleep
OpenProcess
TerminateThread
GetExitCodeThread
WaitForSingleObject
CreateThread
SetLastError
GetProcessHeap
FormatMessageW
LocalFree
GetCurrentProcess
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleExW
CreateNamedPipeW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetCurrentThreadId
GetQueuedCompletionStatus
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
WriteFile
CreateSemaphoreW
ReleaseSemaphore
GetCommandLineW
GetStartupInfoW
HeapFree
HeapAlloc
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
LCMapStringW
GetCPInfo
GetDateFormatA
GetTimeFormatA
CompareStringW
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA

user32

RegisterHotKey
UnregisterHotKey
SetClipboardViewer
OpenClipboard
CallWindowProcA
CallWindowProcW
SetPropW
GetClassLongPtrA
SetWindowLongPtrW
GetClassLongPtrW
IsWindowUnicode
DispatchMessageW
TranslateMessage
GetMessageW
ShowWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostQuitMessage
SendMessageW
GetAsyncKeyState
ChangeClipboardChain
CloseClipboard
EmptyClipboard
SetWindowLongPtrA

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
StartServiceW
CreateServiceW
DeleteService
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW

gdi32

GetStockObject

ole32

CoCreateGuid
StringFromGUID2

Sections

.text
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHARE_N
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bsc20/npasdk.dll
.dll windows:5 windows x86 arch:x86

9b818049de3fee738069205eb82d6407

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8f:b1:e0:78:34:90:1a:0d:5b:e8:8b:2a:cc:b6:18:8b:6d:71:70:63:43:9c:d2:04:d6:42:07:93:c2:4e:6e:e3
Signer

Actual PE Digest

8f:b1:e0:78:34:90:1a:0d:5b:e8:8b:2a:cc:b6:18:8b:6d:71:70:63:43:9c:d2:04:d6:42:07:93:c2:4e:6e:e3

Digest Algorithm

sha256

PE Digest Matches

true

95:17:37:27:3c:e7:25:c6:fd:be:2c:a7:87:8b:94:3c:b0:37:b1:44
Signer

Actual PE Digest

95:17:37:27:3c:e7:25:c6:fd:be:2c:a7:87:8b:94:3c:b0:37:b1:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Build\ASC20\Acs20pkg\Dll\ixNpasdk\Release\npasdk.pdb

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcess
ProcessIdToSessionId
CreateProcessW
WaitForSingleObject
OpenProcess
TerminateProcess
WTSGetActiveConsoleSessionId
CreateEventW
WaitNamedPipeW
FlushFileBuffers
DisconnectNamedPipe
ReadFile
GetOverlappedResult
ResetEvent
WriteFile
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetExitCodeThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleExW
EncodePointer
DecodePointer
GetCommandLineA
RaiseException
HeapFree
Sleep
HeapReAlloc
InterlockedDecrement
GetCPInfo
ExitThread
CreateThread
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
ExitProcess
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetTimeZoneInformation
MultiByteToWideChar
LCMapStringW
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetFilePointer
RtlUnwind
InterlockedExchange
CompareStringW
WriteConsoleW
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
InterlockedCompareExchange
GetProcessHeap
FormatMessageW
HeapAlloc
GetTimeFormatA
GetDateFormatA
GetCurrentProcessId
LocalFree
LocalAlloc
UnmapViewOfFile
MapViewOfFile
GetFileSize
CloseHandle
CreateFileMappingW
GetLastError
CreateFileW
GetProcAddress
LoadLibraryW

shlwapi

PathFileExistsW

userenv

DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

psapi

GetModuleFileNameExW
GetModuleBaseNameW

advapi32

RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
DuplicateTokenEx
GetTokenInformation
OpenProcessToken
RegQueryValueExW
SetKernelObjectSecurity
MakeAbsoluteSD
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
GetLengthSid
SetTokenInformation
GetUserNameW
RegOpenKeyExW
ConvertStringSidToSidW

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cert/cap.npb
cert/certmgr.exe
.exe windows:6 windows x86 arch:x86

7a7c6506fbb24dc5a3e42f717ca920c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

CertMgr.pdb

Imports

advapi32

CryptAcquireContextA
CryptReleaseContext

kernel32

Sleep
InterlockedCompareExchange
RtlUnwind
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
MapViewOfFile
CreateFileMappingA
GetFileSize
WriteFile
WideCharToMultiByte
InterlockedExchange
GetSystemTime
SystemTimeToFileTime
CompareFileTime
MultiByteToWideChar
FileTimeToLocalFileTime
CreateFileW
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
GetLastError
SetLastError
GetModuleHandleA

msvcrt

_controlfp
?terminate@@YAXXZ
malloc
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
scanf
memcpy
_wasctime
memset
_wtol
printf
wprintf
towupper
realloc
free
strtok
_vsnwprintf
_wcsicmp
vwprintf

user32

LoadStringA
LoadStringW

crypt32

CryptInitOIDFunctionSet
CertFreeCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObject
CertFreeCRLContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertFreeCTLContext
CertAddCRLContextToStore
CertAddCTLContextToStore
CertEnumCTLsInStore
CertAddCertificateContextToStore
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertDeleteCTLFromStore
CertDuplicateCTLContext
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CryptStringToBinaryW
CertCloseStore
CertAddEncodedCRLToStore
CertOpenStore
CertAddEncodedCertificateToStore
CertAddEncodedCTLToStore
CertRDNValueToStrW
CryptDecodeObject
CryptFindOIDInfo
CryptFreeOIDFunctionAddress
CryptGetOIDFunctionAddress
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSIPLoad
CryptSIPRetrieveSubjectGuid
CertGetCertificateContextProperty
CertEnumCertificateContextProperties
CertRDNValueToStrA
CertSaveStore
CertGetPublicKeyLength
CryptHashPublicKeyInfo
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CertGetCTLContextProperty
CertFindCTLInStore
CryptInstallOIDFunctionAddress

cryptui

CryptUIDlgCertMgr

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/certutil.exe
.exe windows:5 windows x86 arch:x86

6cf98f135928791c62d2eab6fc3a77b3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10-11-2014 00:00

Not After

10-11-2015 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:d0:95:40:da:1d:e7:d4:b8:c5:01:a4:65:2c:93:34:5b:56:2e:71
Signer

Actual PE Digest

1a:d0:95:40:da:1d:e7:d4:b8:c5:01:a4:65:2c:93:34:5b:56:2e:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nssutil3

SECITEM_CompareItem_Util
PORT_SetError_Util
PORT_ArenaRelease_Util
PORT_ArenaAlloc_Util
SECOID_AddEntry_Util
DER_GetInteger_Util
NSS_Get_SEC_GeneralizedTimeTemplate_Util
CERT_GenTime2FormattedAscii_Util
SECOID_GetAlgorithmTag_Util
SEC_QuickDERDecodeItem_Util
SECOID_FindOID_Util
DER_GeneralizedTimeToTime_Util
DER_UTCTimeToTime_Util
SECITEM_ReallocItemV2
ATOB_ConvertAsciiToItem_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
ATOB_AsciiToData_Util
SEC_ASN1Decode_Util
PORT_Realloc_Util
PORT_Alloc_Util
SECOID_FindOIDTag_Util
SECOID_SetAlgorithmID_Util
SECITEM_ZfreeItem_Util
DER_AsciiToTime_Util
NSS_Get_SEC_ObjectIDTemplate_Util
BTOA_DataToAscii_Util
BTOA_ConvertItemToAscii_Util
SECITEM_AllocItem_Util
PORT_ZAlloc_Util
SEC_ASN1DecodeItem_Util
SECITEM_FreeItem_Util
NSS_Get_SEC_IA5StringTemplate_Util
PORT_ArenaGrow_Util
PORT_GetError_Util
SEC_ASN1EncodeInteger_Util
PORT_Strdup_Util
PORT_ArenaStrdup_Util
PORT_Free_Util
SEC_StringToOID
SECITEM_CopyItem_Util
SEC_ASN1EncodeItem_Util
SECOID_FindOIDByTag_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaMark_Util
PORT_ArenaZAlloc_Util

smime3

CERT_DecodeCertFromPackage

nss3

PK11_GetPrivateKeyNickname
PK11_ListPrivateKeysInSlot
PK11_ListPrivKeysInSlot
PK11_FreeSlotList
PK11_GetSlotName
PK11_GetAllTokens
PK11_DeleteTokenCertAndKey
PK11_FreeSlot
PK11_FindCertFromNickname
PK11_GetInternalKeySlot
CERT_DestroyValidity
CERT_CreateCertificate
CERT_CreateValidity
SECKEY_DestroyPrivateKey
NSS_Get_CERT_CertificateTemplate
PK11_FindKeyByAnyCert
CERT_EncodeAltNameExtension
CERT_MergeExtensions
CERT_GetCertificateRequestExtensions
CERT_StartCertExtensions
PK11_ReadRawAttribute
NSS_Shutdown
SECKEY_DestroyPublicKey
CERT_ExtractPublicKey
PK11_ResetToken
PK11_DestroyMergeLog
PK11_MergeTokens
PK11_CreateMergeLog
SECMOD_CloseUserDB
SECMOD_OpenUserDB
PK11_IsPresent
PK11_IsLoggedIn
PK11_IsRemovable
PK11_IsInternal
PK11_InitPin
PK11_NeedUserInit
PK11_FindSlotByName
CERT_GetDefaultCertDB
NSS_InitWithMerge
NSS_Initialize
PK11_SetPasswordFunc
PK11_GetCertFromPrivateKey
PK11_GenerateKeyPairWithOpFlags
PK11_ProtectedAuthenticationPath
PK11_ChangePW
PK11_CheckUserPassword
CERT_GetOidString
NSS_Get_SECKEY_RSAPSSParamsTemplate
SEC_PKCS5IsAlgorithmPBEAlgTag
CERT_DestroyOidSequence
CERT_DecodeOidSequence
CERT_DecodeBasicConstraintValue
CERT_NameToAscii
CERT_GetCertTrust
CERT_Hexify
PK11_HashBuf
CERT_NewTempCertificate
SECKEY_ExtractPublicKey
CERT_GetNextGeneralName
CERT_DecodeAuthKeyID
CERT_DecodeAltNameExtension
CERT_GetNextNameConstraint
CERT_DecodeNameConstraintsExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeCRLDistributionPoints
CERT_DestroyUserNotice
CERT_DecodeUserNotice
CERT_DestroyCertificatePoliciesExtension
CERT_DecodePrivKeyUsagePeriodExtension
SECKEY_DestroyPrivateKeyList
PK11_GetLowLevelKeyIDForPrivateKey
CERT_VerifyCertificate
SEC_DeletePermCertificate
PK11_ListCerts
PK11_IsFriendly
PK11_NeedLogin
CERT_CreateSubjectCertList
PK11_FindCertsFromEmailAddress
PK11_ListCertsInSlot
CERT_CertChainFromCert
CERT_DestroyCertList
CERT_FindCertByDERCert
CERT_DestroyCertificateList
CERT_FindCertByNicknameOrEmailAddr
SECKEY_CreateSubjectPublicKeyInfo
CERT_CreateCertificateRequest
SECKEY_DestroySubjectPublicKeyInfo
CERT_StartCertificateRequestAttributes
CERT_FinishExtensions
CERT_FinishCertificateRequestAttributes
CERT_DestroyCertificateRequest
SEC_GetSignatureAlgorithmOidTag
SEC_DerSignData
CERT_GetCommonName
CERT_GetCertEmailAddress
CERT_GetOrgName
CERT_GetStateName
CERT_GetCountryName
CERT_DecodeTrustString
PK11_ImportCert
PK11_Authenticate
PK11_GetTokenName
CERT_ChangeCertTrust
CERT_SaveSMimeProfile
CERT_DestroyCertificate
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_CertificateRequestTemplate
PK11_RandomUpdate
CERT_VerifySignedDataWithPublicKeyInfo
CERT_AddExtensionByOID
CERT_EncodeInfoAccessExtension
CERT_EncodeCertPoliciesExtension
CERT_EncodeNoticeReference
CERT_EncodeUserNotice
CERT_EncodePolicyMappingExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodePolicyConstraintsExtension
CERT_CopyRDN
CERT_EncodeCRLDistributionPoints
CERT_EncodeSubjectKeyID
CERT_EncodeAuthKeyID
CERT_EncodeNameConstraintsExtension
CERT_EncodeBasicConstraintValue
CERT_GetGeneralNameTypeFromString
CERT_AddExtension
CERT_EncodeAndAddBitStrExtension
CERT_AsciiToName
CERT_CopyName
CERT_DestroyName
PK11_FindKeyByDERCert

libplc4

PL_strdup
PL_CreateLongOptState
PL_GetNextOpt
PL_DestroyOptState
PL_strncasecmp
PL_strcmp
PL_strlen
PL_strndup
PL_strfree

libplds4

PL_ArenaFinish

libnspr4

PR_GetErrorText
PR_ErrorToName
PR_IsNetAddrType
PR_NetAddrToString
PR_FormatTime
PR_GetEnv
PR_GetOpenFileInfo
PR_Read
PR_Cleanup
PR_GetOSError
PR_Init
PR_GetError
PR_GMTParameters
PR_ExplodeTime
PR_ImplodeTime
PR_GetSpecialFD
PR_ErrorToString
PR_Now
PR_Write
PR_fprintf
PR_smprintf
PR_smprintf_free
PR_Open
PR_Close
PR_snprintf
PR_StringToNetAddr
PR_GetErrorTextLength

msvcr90

_getch
_fileno
_isatty
_strdup
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
tolower
_errno
strerror
vfprintf
isprint
getc
strstr
fopen
strpbrk
isspace
fclose
strncpy
exit
sprintf
memset
printf
strchr
strncmp
memcpy
strtol
puts
fprintf
fputs
fflush
__iob_func
fgets
strrchr

kernel32

QueryPerformanceCounter
Sleep
InterlockedCompareExchange
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cert/freebl3.dll
.dll windows:5 windows x86 arch:x86

3e4d9b447a2cb87a729730ab1bc25121

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nssutil3

SECITEM_CompareItem_Util
SECITEM_ZfreeItem_Util
SECOID_FindOIDTag_Util
PORT_ArenaAlloc_Util
SECITEM_FreeItem_Util
SECITEM_CopyItem_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
SECITEM_AllocItem_Util
NSS_SecureMemcmp
PORT_GetError_Util
PORT_ZFree_Util
PORT_ZAlloc_Util
PORT_SetError_Util
PORT_Free_Util
PORT_Alloc_Util

libnspr4

PR_GetLibraryFilePathname
PR_Free
PR_Open
PR_Seek
PR_Close
PR_Read
PR_DestroyCondVar
PR_WaitCondVar
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_NewCondVar
PR_Lock
PR_Unlock
PR_CallOnce
PR_NewLock
PR_DestroyLock

advapi32

SystemFunction036

msvcr90

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_except_handler4_common
abort
_time64
memcpy
memset
strncmp
rand
free
malloc
_strdup
calloc
islower
isupper
isdigit
toupper
_encode_pointer
_malloc_crt
_encoded_null

kernel32

GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetLogicalDrives
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetVolumeInformationA
GetDiskFreeSpaceA
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus

Exports

Exports

FREEBL_GetVector

Sections

.text
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/libnspr4.dll
.dll windows:5 windows x86 arch:x86

a6e2b1f247cdd390d167c7adf25361a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AllocateAndInitializeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor

ws2_32

WSACleanup
WSASetLastError
select
recvfrom
sendto
recv
__WSAFDIsSet
getpeername
shutdown
setsockopt
ioctlsocket
send
gethostname
socket
bind
getsockname
listen
connect
accept
getsockopt
ntohl
ntohs
htons
getprotobynumber
getprotobyname
gethostbyaddr
gethostbyname
htonl
closesocket
WSAGetLastError
WSAStartup

winmm

timeGetTime

mswsock

TransmitFile
AcceptEx
GetAcceptExSockaddrs

msvcr90

_lock
_onexit
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_except_handler4_common
_time64
_beginthreadex
_exit
_endthreadex
_access
_mbsdec
_stat64i32
_mbsinc
qsort
_stricmp
strpbrk
memmove
isalpha
strftime
_mktime64
_localtime64
strncmp
_errno
strerror
realloc
calloc
malloc
strrchr
strstr
getenv
strchr
isdigit
strtoul
strtol
isspace
tolower
memchr
_snprintf
abort
free
fwrite
fflush
fopen
setvbuf
fclose
sscanf
memcpy
exit
__iob_func
fprintf
atoi
memset
_strdup
_environ
_putenv

kernel32

GetFileInformationByHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OpenFileMappingA
GetTickCount
QueryPerformanceCounter
OpenSemaphoreA
SetLastError
SwitchToFiber
CreateFiber
ResumeThread
SuspendThread
GetProcessAffinityMask
SetThreadAffinityMask
ConvertThreadToFiber
IsDebuggerPresent
RaiseException
SetThreadPriority
GetCurrentThread
DuplicateHandle
CreateEventA
TlsFree
TlsAlloc
Sleep
CancelIo
GetLogicalDriveStringsA
SetErrorMode
GetDriveTypeA
GetVolumeInformationA
lstrlenA
UnlockFileEx
LockFileEx
RemoveDirectoryA
CreateDirectoryA
GetFileAttributesExA
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
GetHandleInformation
SetHandleInformation
CreateFileA
SetFilePointer
WriteFile
WaitForMultipleObjects
GetOverlappedResult
ResetEvent
CreateIoCompletionPort
PostQueuedCompletionStatus
DeleteFiber
GetQueuedCompletionStatus
GetThreadContext
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcess
FlushViewOfFile
FlushFileBuffers
UnmapViewOfFile
MapViewOfFile
FormatMessageA
CreateFileMappingA
GetVersionExA
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTime
SystemTimeToFileTime
TryEnterCriticalSection
GetStdHandle
CreatePipe
MoveFileA
CloseHandle
GlobalMemoryStatusEx
InterlockedExchange
GetSystemInfo
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleA
WideCharToMultiByte
DebugBreak
TlsGetValue
TlsSetValue
OutputDebugStringA
GetLastError
ReadFile
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadName
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_GetVersion
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NTFast_Accept
PR_NTFast_AcceptRead
PR_NTFast_AcceptRead_WithTimeoutCallback
PR_NTFast_UpdateAcceptContext
PR_NT_CancelIo
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetCurrentThreadName
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_SyncMemMap
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/libplc4.dll
.dll windows:5 windows x86 arch:x86

4186cd42be9b2afabef8dd72516938ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_SetError
PR_Calloc
PR_GetSpecialFD
PR_GetError
PR_GetOSError
PR_ErrorToName
PR_fprintf
PR_Free
PR_Malloc

msvcr90

strrchr
strpbrk
strstr
_encode_pointer
_malloc_crt
strchr
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
strncmp
free
memcpy
malloc
_encoded_null

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 538B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/libplds4.dll
.dll windows:5 windows x86 arch:x86

b6d90a32750acf0af0a8655d5d0a030b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_DestroyLock
PR_Free
PR_Malloc
PR_CeilingLog2
PR_Unlock
PR_CallOnce
PR_Lock
PR_NewLock

msvcr90

_decode_pointer
_initterm
_encoded_null
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
free
_malloc_crt
_encode_pointer
memset
memcpy
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
PL_SizeOfArenaPoolExcludingPool
libVersionPoint

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 514B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/nprotect-root_ca.cer
cert/nprotect-rootca.cer
cert/nss3.dll
.dll windows:5 windows x86 arch:x86

efa8fe274715a84c91d43a09226843bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nssutil3

PORT_UCS4_UTF8Conversion
PORT_ISO88591_UTF8Conversion
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
NSSUTIL_MkModuleSpec
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_SEC_SetOfAnyTemplate_Util
NSSUTIL_DoubleEscapeSize
NSSUTIL_ArgStrip
DER_LengthLength
NSSUTIL_ArgFetchValue
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgGetLabel
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgIsBlank
NSSUTIL_EscapeSize
NSSUTIL_Escape
NSSUTIL_ArgHasFlag
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgParseSlotInfo
NSSUTIL_ArgReadLong
DER_StoreHeader
DER_GetUInteger
SECOID_KnownCertExtenOID
NSS_Get_SEC_IA5StringTemplate_Util
SECITEM_HashCompare
SECITEM_Hash
PORT_RegExpValid
PORT_RegExpCaseSearch
NSS_Get_SEC_SkipTemplate
SEC_StringToOID
NSSUTIL_ArgParseModuleSpec
NSSUTIL_MkSlotString
PORT_FreeArena_Util
NSSUTIL_MkNSSString
NSSUTIL_ArgParseCipherFlags
SECOID_FindOIDByMechanism
PORT_LoadLibraryFromOrigin
NSS_Get_SEC_ObjectIDTemplate_Util
_SGN_VerifyPKCS1DigestInfo
SGN_DecodeDigestInfo
NSS_Get_SEC_BitStringTemplate_Util
NSS_GetAlgorithmPolicy
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_IntegerTemplate_Util
DER_SetUInteger
NSS_Get_SEC_AnyTemplate_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_UnlockWrite_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_LockRead_Util
NSSRWLock_Destroy_Util
NSSRWLock_New_Util
NSSBase64_EncodeItem_Util
NSSBase64_DecodeBuffer_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Decoder_Create_Util
BTOA_ConvertItemToAscii_Util
ATOB_ConvertAsciiToItem_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
SEC_ASN1LengthLength_Util
SEC_ASN1DecodeInteger_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1EncoderStart_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderStart_Util
DER_EncodeTimeChoice_Util
DER_DecodeTimeChoice_Util
CERT_GenTime2FormattedAscii_Util
DER_GeneralizedTimeToTime_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeChoiceDayToAscii_Util
DER_GeneralizedDayToAscii_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
DER_AsciiToTime_Util
DER_TimeToUTCTime_Util
DER_GetInteger_Util
DER_Lengths_Util
DER_Encode_Util
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_DupItem_Util
SECITEM_CopyItem_Util
SECITEM_ItemsAreEqual_Util
SECITEM_CompareItem_Util
SECITEM_AllocItem_Util
SECOID_AddEntry_Util
SECOID_FindOIDTagDescription_Util
SECOID_CompareAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDByTag_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
NSS_PutEnv_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaRelease_Util
PORT_ArenaMark_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util
PORT_NewArena_Util
PORT_GetError_Util
PORT_ZFree_Util
PORT_Realloc_Util
SECOID_Init
SECOID_Shutdown
PORT_ZAlloc_Util
NSS_InitializePRErrorTable
PORT_SetError_Util
NSSUTIL_DoubleEscape
PORT_Free_Util
PORT_Strdup_Util
NSS_Get_SEC_T61StringTemplate
PORT_Alloc_Util

libplc4

PL_strdup
PL_strfree
PL_strnstr
PL_strstr
PL_strcat
PL_strlen
PL_strncpyz
PL_strcatn
PL_strcasecmp
PL_strncasecmp
PL_Base64Encode

libplds4

PL_HashString
PL_FinishArenaPool
PL_InitArenaPool
PL_ArenaAllocate
PL_ArenaRelease
PL_HashTableEnumerateEntries
PL_HashTableDestroy
PL_CompareValues
PL_NewHashTable
PL_HashTableAdd
PL_HashTableRemove
PL_HashTableLookup
PL_CompareStrings

libnspr4

PR_htons
PR_Accept
PR_Send
PR_Shutdown
PR_Listen
PR_ConnectContinue
PR_Bind
PR_ErrorToString
PR_FindFunctionSymbol
PR_DestroyRWLock
PR_Realloc
PR_Malloc
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_Free
PR_Calloc
PR_sprintf_append
PR_GetError
PR_NetAddrToString
PR_ConvertIPv4AddrToIPv6
PR_htonl
PR_SetErrorText
PR_Sleep
PR_FindSymbol
PR_LoadLibrary
PR_UnloadLibrary
PR_IntervalToSeconds
PR_IntervalToMilliseconds
PR_IntervalToMicroseconds
PR_NewLogModule
PR_LogPrint
PR_CallOnceWithArg
PR_IntervalNow
PR_GetEnv
PR_Poll
PR_TicksPerSecond
PR_Recv
PR_snprintf
PR_Write
PR_NewTCPSocket
PR_SecondsToInterval
PR_StringToNetAddr
PR_GetHostByName
PR_EnumerateHostEnt
PR_Connect
PR_InitializeNetAddr
PR_Close
PR_DestroyMonitor
PR_NewMonitor
PR_Now
PR_EnterMonitor
PR_ExitMonitor
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_CallOnce
PR_Lock
PR_Unlock
PR_WaitCondVar
PR_DestroyLock
PR_NewLock
PR_NewCondVar
PR_smprintf
PR_smprintf_free

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
isxdigit
isupper
printf
qsort
tolower
fopen
__iob_func
fprintf
fflush
fclose
isspace
strstr
strchr
atoi
memmove
strtol
strncmp
getenv
isdigit
memcpy
strrchr
memset
_mktemp

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Exports

Exports

ATOB_AsciiToData
ATOB_ConvertAsciiToItem
BTOA_ConvertItemToAscii
BTOA_DataToAscii
CERT_AddCertToListHead
CERT_AddCertToListSorted
CERT_AddCertToListTail
CERT_AddExtension
CERT_AddExtensionByOID
CERT_AddOCSPAcceptableResponses
CERT_AddOKDomainName
CERT_AddRDN
CERT_AllocCERTRevocationFlags
CERT_AsciiToName
CERT_CRLCacheRefreshIssuer
CERT_CacheCRL
CERT_CacheOCSPResponseFromSideChannel
CERT_CertChainFromCert
CERT_CertListFromCert
CERT_CertTimesValid
CERT_ChangeCertTrust
CERT_CheckCertUsage
CERT_CheckCertValidTimes
CERT_CheckNameSpace
CERT_CheckOCSPStatus
CERT_ClearOCSPCache
CERT_CompareCerts
CERT_CompareName
CERT_CompareValidityTimes
CERT_CompleteCRLDecodeEntries
CERT_CopyName
CERT_CopyRDN
CERT_CreateAVA
CERT_CreateCertificate
CERT_CreateCertificateRequest
CERT_CreateEncodedOCSPErrorResponse
CERT_CreateEncodedOCSPSuccessResponse
CERT_CreateName
CERT_CreateOCSPCertID
CERT_CreateOCSPRequest
CERT_CreateOCSPSingleResponseGood
CERT_CreateOCSPSingleResponseRevoked
CERT_CreateOCSPSingleResponseUnknown
CERT_CreateRDN
CERT_CreateSubjectCertList
CERT_CreateValidity
CERT_DecodeAVAValue
CERT_DecodeAltNameExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeAuthKeyID
CERT_DecodeBasicConstraintValue
CERT_DecodeCRLDistributionPoints
CERT_DecodeCertificatePoliciesExtension
CERT_DecodeDERCrl
CERT_DecodeDERCrlWithFlags
CERT_DecodeGeneralName
CERT_DecodeNameConstraintsExtension
CERT_DecodeOCSPRequest
CERT_DecodeOCSPResponse
CERT_DecodeOidSequence
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DecodeTrustString
CERT_DecodeUserNotice
CERT_DerNameToAscii
CERT_DestroyCERTRevocationFlags
CERT_DestroyCertArray
CERT_DestroyCertList
CERT_DestroyCertificate
CERT_DestroyCertificateList
CERT_DestroyCertificatePoliciesExtension
CERT_DestroyCertificateRequest
CERT_DestroyName
CERT_DestroyOCSPCertID
CERT_DestroyOCSPRequest
CERT_DestroyOCSPResponse
CERT_DestroyOidSequence
CERT_DestroyUserNotice
CERT_DestroyValidity
CERT_DisableOCSPChecking
CERT_DisableOCSPDefaultResponder
CERT_DistNamesFromCertList
CERT_DupCertList
CERT_DupCertificate
CERT_DupDistNames
CERT_EnableOCSPChecking
CERT_EnableOCSPDefaultResponder
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeCRLDistributionPoints
CERT_EncodeCertPoliciesExtension
CERT_EncodeGeneralName
CERT_EncodeInfoAccessExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodeNameConstraintsExtension
CERT_EncodeNoticeReference
CERT_EncodeOCSPRequest
CERT_EncodePolicyConstraintsExtension
CERT_EncodePolicyMappingExtension
CERT_EncodeSubjectKeyID
CERT_EncodeUserNotice
CERT_ExtractPublicKey
CERT_FilterCertListByCANames
CERT_FilterCertListByUsage
CERT_FilterCertListForUserCerts
CERT_FindCRLEntryReasonExten
CERT_FindCRLNumberExten
CERT_FindCertByDERCert
CERT_FindCertByIssuerAndSN
CERT_FindCertByName
CERT_FindCertByNickname
CERT_FindCertByNicknameOrEmailAddr
CERT_FindCertByNicknameOrEmailAddrForUsage
CERT_FindCertBySubjectKeyID
CERT_FindCertExtension
CERT_FindCertIssuer
CERT_FindKeyUsageExtension
CERT_FindNameConstraintsExten
CERT_FindSMimeProfile
CERT_FindSubjectKeyIDExtension
CERT_FindUserCertByUsage
CERT_FindUserCertsByUsage
CERT_FinishCertificateRequestAttributes
CERT_FinishExtensions
CERT_ForcePostMethodForOCSP
CERT_FormatName
CERT_FreeDistNames
CERT_FreeNicknames
CERT_GenTime2FormattedAscii
CERT_GetAVATag
CERT_GetCertChainFromCert
CERT_GetCertEmailAddress
CERT_GetCertIssuerAndSN
CERT_GetCertNicknames
CERT_GetCertTimes
CERT_GetCertTrust
CERT_GetCertUid
CERT_GetCertificateNames
CERT_GetCertificateRequestExtensions
CERT_GetClassicOCSPDisabledPolicy
CERT_GetClassicOCSPEnabledHardFailurePolicy
CERT_GetClassicOCSPEnabledSoftFailurePolicy
CERT_GetCommonName
CERT_GetConstrainedCertificateNames
CERT_GetCountryName
CERT_GetDBContentVersion
CERT_GetDefaultCertDB
CERT_GetDomainComponentName
CERT_GetEncodedOCSPResponse
CERT_GetFirstEmailAddress
CERT_GetGeneralNameTypeFromString
CERT_GetLocalityName
CERT_GetNextEmailAddress
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
CERT_GetOCSPAuthorityInfoAccessLocation
CERT_GetOCSPResponseStatus
CERT_GetOCSPStatusForCertID
CERT_GetOidString
CERT_GetOrgName
CERT_GetOrgUnitName
CERT_GetPKIXVerifyNistRevocationPolicy
CERT_GetPrevGeneralName
CERT_GetPrevNameConstraint
CERT_GetSSLCACerts
CERT_GetSlopTime
CERT_GetStateName
CERT_GetSubjectNameDigest
CERT_GetSubjectPublicKeyDigest
CERT_GetUsePKIXForValidation
CERT_GetValidDNSPatternsFromCert
CERT_Hexify
CERT_ImportCAChain
CERT_ImportCAChainTrusted
CERT_ImportCRL
CERT_ImportCerts
CERT_IsCACert
CERT_IsCADERCert
CERT_IsRootDERCert
CERT_IsUserCert
CERT_KeyFromDERCrl
CERT_MakeCANickname
CERT_MergeExtensions
CERT_NameToAscii
CERT_NameToAsciiInvertible
CERT_NewCertList
CERT_NewTempCertificate
CERT_NicknameStringsFromCertList
CERT_OCSPCacheSettings
CERT_OpenCertDBFilename
CERT_PKIXVerifyCert
CERT_PostOCSPRequest
CERT_RFC1485_EscapeAndQuote
CERT_RegisterAlternateOCSPAIAInfoCallBack
CERT_RemoveCertListNode
CERT_SaveSMimeProfile
CERT_SetOCSPDefaultResponder
CERT_SetOCSPFailureMode
CERT_SetOCSPTimeout
CERT_SetSlopTime
CERT_SetUsePKIXForValidation
CERT_StartCRLEntryExtensions
CERT_StartCRLExtensions
CERT_StartCertExtensions
CERT_StartCertificateRequestAttributes
CERT_UncacheCRL
CERT_VerifyCACertForUsage
CERT_VerifyCert
CERT_VerifyCertName
CERT_VerifyCertNow
CERT_VerifyCertificate
CERT_VerifyCertificateNow
CERT_VerifyOCSPResponseSignature
CERT_VerifySignedData
CERT_VerifySignedDataWithPublicKey
CERT_VerifySignedDataWithPublicKeyInfo
DER_AsciiToTime
DER_DecodeTimeChoice
DER_Encode
DER_EncodeTimeChoice
DER_GeneralizedDayToAscii
DER_GeneralizedTimeToTime
DER_GetInteger
DER_Lengths
DER_TimeChoiceDayToAscii
DER_TimeToGeneralizedTime
DER_TimeToGeneralizedTimeArena
DER_TimeToUTCTime
DER_UTCDayToAscii
DER_UTCTimeToAscii
DER_UTCTimeToTime
DSAU_DecodeDerSig
DSAU_DecodeDerSigToLen
DSAU_EncodeDerSig
DSAU_EncodeDerSigWithLen
HASH_Begin
HASH_Clone
HASH_Create
HASH_Destroy
HASH_End
HASH_GetHashObject
HASH_GetHashObjectByOidTag
HASH_GetHashTypeByOidTag
HASH_GetType
HASH_HashBuf
HASH_ResultLen
HASH_ResultLenByOidTag
HASH_ResultLenContext
HASH_Update
NSSBase64Decoder_Create
NSSBase64Decoder_Destroy
NSSBase64Decoder_Update
NSSBase64Encoder_Create
NSSBase64Encoder_Destroy
NSSBase64Encoder_Update
NSSBase64_DecodeBuffer
NSSBase64_EncodeItem
NSSRWLock_Destroy
NSSRWLock_HaveWriteLock
NSSRWLock_LockRead
NSSRWLock_LockWrite
NSSRWLock_New
NSSRWLock_UnlockRead
NSSRWLock_UnlockWrite
NSS_GetVersion
NSS_Get_CERT_CertificateRequestTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CrlTemplate
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_NameTemplate
NSS_Get_CERT_SequenceOfCertExtensionTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
NSS_Get_CERT_SignedCrlTemplate
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_SubjectPublicKeyInfoTemplate
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SECKEY_DSAPublicKeyTemplate
NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_RSAPSSParamsTemplate
NSS_Get_SECKEY_RSAPublicKeyTemplate
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_AnyTemplate
NSS_Get_SEC_BMPStringTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_BooleanTemplate
NSS_Get_SEC_GeneralizedTimeTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_IntegerTemplate
NSS_Get_SEC_NullTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToAnyTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
NSS_Get_SEC_SignedCertificateTemplate
NSS_Get_SEC_UTCTimeTemplate
NSS_Get_SEC_UTF8StringTemplate
NSS_Get_sgn_DigestInfoTemplate
NSS_Init
NSS_InitContext
NSS_InitReadWrite
NSS_InitWithMerge
NSS_Initialize
NSS_IsInitialized
NSS_NoDB_Init
NSS_PutEnv
NSS_RegisterShutdown
NSS_Shutdown
NSS_ShutdownContext
NSS_UnregisterShutdown
NSS_VersionCheck
PBE_CreateContext
PBE_DestroyContext
PBE_GenerateBits
PK11SDR_Decrypt
PK11SDR_Encrypt
PK11_AlgtagToMechanism
PK11_Authenticate
PK11_BlockData
PK11_ChangePW
PK11_CheckSSOPassword
PK11_CheckUserPassword
PK11_CipherOp
PK11_CloneContext
PK11_ConfigurePKCS11
PK11_ConvertSessionPrivKeyToTokenPrivKey
PK11_ConvertSessionSymKeyToTokenSymKey
PK11_CopySymKeyForSigning
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_CreateContextBySymKey
PK11_CreateDigestContext
PK11_CreateGenericObject
PK11_CreateMergeLog
PK11_CreatePBEAlgorithmID
PK11_CreatePBEParams
PK11_CreatePBEV2AlgorithmID
PK11_DEREncodePublicKey
PK11_Decrypt
PK11_DeleteTokenCertAndKey
PK11_DeleteTokenPrivateKey
PK11_DeleteTokenPublicKey
PK11_DeleteTokenSymKey
PK11_Derive
PK11_DeriveWithFlags
PK11_DeriveWithFlagsPerm
PK11_DeriveWithTemplate
PK11_DestroyContext
PK11_DestroyGenericObject
PK11_DestroyGenericObjects
PK11_DestroyMergeLog
PK11_DestroyObject
PK11_DestroyPBEParams
PK11_DestroyTokenObject
PK11_DigestBegin
PK11_DigestFinal
PK11_DigestKey
PK11_DigestOp
PK11_DoesMechanism
PK11_Encrypt
PK11_ExportDERPrivateKeyInfo
PK11_ExportEncryptedPrivKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
PK11_ExportPrivKeyInfo
PK11_ExportPrivateKeyInfo
PK11_ExtractKeyValue
PK11_Finalize
PK11_FindBestKEAMatch
PK11_FindCertAndKeyByRecipientList
PK11_FindCertAndKeyByRecipientListNew
PK11_FindCertByIssuerAndSN
PK11_FindCertFromDERCert
PK11_FindCertFromDERCertItem
PK11_FindCertFromNickname
PK11_FindCertInSlot
PK11_FindCertsFromEmailAddress
PK11_FindCertsFromNickname
PK11_FindFixedKey
PK11_FindGenericObjects
PK11_FindKeyByAnyCert
PK11_FindKeyByDERCert
PK11_FindKeyByKeyID
PK11_FindPrivateKeyFromCert
PK11_FindSlotByName
PK11_FindSlotsByNames
PK11_FortezzaHasKEA
PK11_FortezzaMapSig
PK11_FreeSlot
PK11_FreeSlotList
PK11_FreeSlotListElement
PK11_FreeSymKey
PK11_GenerateFortezzaIV
PK11_GenerateKeyPair
PK11_GenerateKeyPairWithFlags
PK11_GenerateKeyPairWithOpFlags
PK11_GenerateNewParam
PK11_GenerateRandom
PK11_GenerateRandomOnSlot
PK11_GetAllSlotsForCert
PK11_GetAllTokens
PK11_GetBestKeyLength
PK11_GetBestSlot
PK11_GetBestSlotMultiple
PK11_GetBestSlotMultipleWithAttributes
PK11_GetBestSlotWithAttributes
PK11_GetBestWrapMechanism
PK11_GetBlockSize
PK11_GetCertFromPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetDefaultArray
PK11_GetDefaultFlags
PK11_GetDisabledReason
PK11_GetFirstSafe
PK11_GetIVLength
PK11_GetInternalKeySlot
PK11_GetInternalSlot
PK11_GetKeyData
PK11_GetKeyGen
PK11_GetKeyLength
PK11_GetKeyStrength
PK11_GetKeyType
PK11_GetLowLevelKeyIDForCert
PK11_GetLowLevelKeyIDForPrivateKey
PK11_GetMechanism
PK11_GetMinimumPwdLength
PK11_GetModInfo
PK11_GetModule
PK11_GetModuleID
PK11_GetNextGenericObject
PK11_GetNextSafe
PK11_GetNextSymKey
PK11_GetPBECryptoMechanism
PK11_GetPBEIV
PK11_GetPQGParamsFromPrivateKey
PK11_GetPadMechanism
PK11_GetPrevGenericObject
PK11_GetPrivateKeyNickname
PK11_GetPrivateModulusLen
PK11_GetPublicKeyNickname
PK11_GetSlotFromKey
PK11_GetSlotFromPrivateKey
PK11_GetSlotID
PK11_GetSlotInfo
PK11_GetSlotName
PK11_GetSlotPWValues
PK11_GetSlotSeries
PK11_GetSymKeyHandle
PK11_GetSymKeyNickname
PK11_GetSymKeyType
PK11_GetSymKeyUserData
PK11_GetTokenInfo
PK11_GetTokenName
PK11_GetWindow
PK11_GetWrapKey
PK11_HasRootCerts
PK11_HashBuf
PK11_IVFromParam
PK11_ImportCRL
PK11_ImportCert
PK11_ImportCertForKey
PK11_ImportCertForKeyToSlot
PK11_ImportDERCert
PK11_ImportDERCertForKey
PK11_ImportDERPrivateKeyInfo
PK11_ImportDERPrivateKeyInfoAndReturnKey
PK11_ImportEncryptedPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey
PK11_ImportPrivateKeyInfo
PK11_ImportPrivateKeyInfoAndReturnKey
PK11_ImportPublicKey
PK11_ImportSymKey
PK11_ImportSymKeyWithFlags
PK11_InitPin
PK11_IsDisabled
PK11_IsFIPS
PK11_IsFriendly
PK11_IsHW
PK11_IsInternal
PK11_IsInternalKeySlot
PK11_IsLoggedIn
PK11_IsPresent
PK11_IsReadOnly
PK11_IsRemovable
PK11_KeyForCertExists
PK11_KeyForDERCertExists
PK11_KeyGen
PK11_KeyGenWithTemplate
PK11_LinkGenericObject
PK11_ListCerts
PK11_ListCertsInSlot
PK11_ListFixedKeysInSlot
PK11_ListPrivKeysInSlot
PK11_ListPrivateKeysInSlot
PK11_ListPublicKeysInSlot
PK11_LoadPrivKey
PK11_Logout
PK11_LogoutAll

Sections

.text
Size: 645KB - Virtual size: 645KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/nssckbi.dll
.dll windows:4 windows x86 arch:x86

de0b17169e4935cc5b411afde9f0b737

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strlen

libplds4

PL_ArenaAllocate
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableDestroy
PL_CompareValues
PL_NewHashTable
PL_FinishArenaPool
PL_InitArenaPool

libnspr4

PR_CallOnce
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_Free
PR_Calloc
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock

msvcr80

_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
memcpy
memset
memmove
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/nssdbm3.dll
.dll windows:5 windows x86 arch:x86

4ca60f6a5ff6fd16b9c793ebf3278574

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplds4

PL_HashTableEnumerateEntries
PL_HashTableAdd
PL_HashTableLookup
PL_HashTableRemove
PL_NewHashTable
PL_HashTableDestroy

libnspr4

PR_CallOnce
PR_FindFunctionSymbol
PR_GetLibraryFilePathname
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_NewMonitor
PR_DestroyMonitor
PR_ExitMonitor
PR_EnterMonitor
PR_Now
PR_LoadLibrary
PR_FindSymbol
PR_GetEnv
PR_UnloadLibrary
PR_Free
PR_htonl
PR_ntohl
PR_DestroyLock
PR_Lock
PR_Unlock
PR_SetError
PR_NewLock
PR_CreateFileMap
PR_MemMap
PR_Read
PR_MemUnmap
PR_CloseFileMap
PR_Access
PR_MkDir
PR_OpenFile
PR_GetError
PR_Write
PR_Close
PR_Delete
PR_smprintf_free
PR_smprintf

nssutil3

NSSUTIL_Quote
NSSUTIL_ArgParseSlotFlags
NSSUTIL_MkSlotString
NSSUTIL_MkNSSString
NSSUTIL_MkModuleSpec
NSSUTIL_ArgParseModuleSpec
NSSUTIL_ArgParseSlotInfo
NSSUTIL_ArgHasFlag
NSSUTIL_ArgReadLong
NSSUTIL_ArgParseCipherFlags
NSSUTIL_ArgGetParamValue
SECITEM_CompareItem_Util
PORT_ArenaStrdup_Util
PORT_ArenaMark_Util
PORT_ArenaUnmark_Util
PORT_ArenaRelease_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
DER_DecodeTimeChoice_Util
SECITEM_AllocItem_Util
SECOID_Init
SECITEM_HashCompare
SECOID_Shutdown
SECITEM_ItemsAreEqual_Util
PORT_Realloc_Util
DER_SetUInteger
NSS_Get_SEC_OctetStringTemplate_Util
PORT_Strdup_Util
SECOID_FindOIDTag_Util
SECITEM_FreeItem_Util
SECOID_FindOIDByTag_Util
PORT_ArenaAlloc_Util
PORT_GetError_Util
SECITEM_ZfreeItem_Util
SEC_ASN1EncodeInteger_Util
SEC_QuickDERDecodeItem_Util
SECOID_GetAlgorithmTag_Util
SECITEM_CopyItem_Util
SECITEM_DupItem_Util
SEC_ASN1EncodeItem_Util
SECOID_SetAlgorithmID_Util
PORT_SetError_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_ZAlloc_Util
PORT_Alloc_Util
PORT_Free_Util
NSSBase64_EncodeItem_Util
NSS_Get_SEC_ObjectIDTemplate_Util

msvcr90

_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_encode_pointer
__dllonexit
_lock
_onexit
_except_handler4_common
isdigit
abort
calloc
malloc
memmove
free
_get_osfhandle
_stat64i32
_errno
strrchr
memset
memcpy
_strdup
_open
_read
_close
_unlink
_write
_lseek
getenv
strncmp
_unlock
_getpid
tolower

kernel32

GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
FlushFileBuffers
GetCurrentProcessId

Exports

Exports

legacy_AddSecmodDB
legacy_DeleteSecmodDB
legacy_Open
legacy_ReadSecmodDB
legacy_ReleaseSecmodDBData
legacy_SetCryptFunctions
legacy_Shutdown

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/nssutil3.dll
.dll windows:5 windows x86 arch:x86

d4971a2a6e8d38336c0b6a933639b728

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strncasecmp
PL_strcasecmp
PL_strpbrk
PL_strlen

libplds4

PL_FreeArenaPool
PL_FinishArenaPool
PL_ArenaAllocate
PL_HashTableDestroy
PL_ClearArenaPool
PL_HashTableLookup
PL_CompareValues
PL_NewHashTable
PL_HashTableAdd
PL_ArenaGrow
PL_ArenaRelease
PL_InitArenaPool
PL_HashTableLookupConst

libnspr4

PR_Access
PR_smprintf_free
PR_Delete
PR_Rename
PR_smprintf
PR_GetError
PR_LocalTimeParameters
PR_FormatTime
PR_GetEnv
PR_GetLibraryFilePathname
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_NewLock
PR_NewCondVar
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_GetCurrentThread
PR_Lock
PR_WaitCondVar
PR_Unlock
PR_DestroyCondVar
PR_DestroyLock
PR_Free
PR_Realloc
PR_Malloc
PR_SetError
PR_Calloc
PR_CallOnce
PR_ErrorInstallTable
PR_ImplodeTime
PR_GMTParameters
PR_ExplodeTime

msvcr90

toupper
_putenv
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
atoi
strncpy
isspace
fprintf
_stat64i32
fopen
fclose
fgets
fwrite
strncmp
fputs
_open
_fdopen
strncat
strstr
strrchr
memcpy
isdigit
tolower
memset
_close
isalpha
isalnum
strchr

kernel32

IsDebuggerPresent
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
SetEnvironmentVariableA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep

Exports

Exports

ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
CERT_GenTime2FormattedAscii_Util
DER_AsciiToTime_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
DER_Encode_Util
DER_GeneralizedDayToAscii_Util
DER_GeneralizedTimeToTime_Util
DER_GetInteger_Util
DER_GetUInteger
DER_LengthLength
DER_Lengths_Util
DER_SetUInteger
DER_StoreHeader
DER_TimeChoiceDayToAscii_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeToUTCTime_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
NSSBase64Decoder_Create_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64_DecodeBuffer_Util
NSSBase64_EncodeItem_Util
NSSRWLock_Destroy_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_LockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_New_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_UnlockWrite_Util
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgFetchValue
NSSUTIL_ArgGetLabel
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgParseCipherFlags
NSSUTIL_ArgParseModuleSpec
NSSUTIL_ArgParseSlotFlags
NSSUTIL_ArgParseSlotInfo
NSSUTIL_ArgReadLong
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_DoModuleDBFunction
NSSUTIL_DoubleEscape
NSSUTIL_DoubleEscapeSize
NSSUTIL_Escape
NSSUTIL_EscapeSize
NSSUTIL_GetVersion
NSSUTIL_MkModuleSpec
NSSUTIL_MkNSSString
NSSUTIL_MkSlotString
NSSUTIL_Quote
NSSUTIL_QuoteSize
NSS_GetAlgorithmPolicy
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_BooleanTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_SkipTemplate
NSS_Get_SEC_T61StringTemplate
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_sgn_DigestInfoTemplate_Util
NSS_InitializePRErrorTable
NSS_PutEnv_Util
NSS_SecureMemcmp
NSS_SetAlgorithmPolicy
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_ISO88591_UTF8Conversion
PORT_LoadLibraryFromOrigin
PORT_NewArena_Util
PORT_Realloc_Util
PORT_RegExpCaseSearch
PORT_RegExpSearch
PORT_RegExpValid
PORT_SetError_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_Strdup_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_UCS4_UTF8Conversion
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocArray
SECITEM_AllocItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_DupArray
SECITEM_DupItem_Util
SECITEM_FreeArray
SECITEM_FreeItem_Util
SECITEM_Hash
SECITEM_HashCompare
SECITEM_ItemsAreEqual_Util
SECITEM_ReallocItem
SECITEM_ReallocItemV2
SECITEM_ZfreeArray
SECITEM_ZfreeItem_Util
SECOID_AddEntry_Util
SECOID_CompareAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_FindOIDByMechanism
SECOID_FindOIDByTag_Util
SECOID_FindOIDTagDescription_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
SECOID_GetAlgorithmTag_Util
SECOID_Init
SECOID_KnownCertExtenOID
SECOID_SetAlgorithmID_Util
SECOID_Shutdown
SEC_ASN1DecodeInteger_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1LengthLength_Util
SEC_QuickDERDecodeItem_Util
SEC_StringToOID
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_CreateDigestInfo_Util
SGN_DecodeDigestInfo
SGN_DestroyDigestInfo_Util
UTIL_SetForkState
_NSSUTIL_EvaluateConfigDir
_NSSUTIL_GetSecmodName
_SGN_VerifyPKCS1DigestInfo

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/smime3.dll
.dll windows:5 windows x86 arch:x86

8045583735bc5ff78d5914c02f8eecf4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

CERT_FindCertByIssuerAndSN
CERT_FindCertBySubjectKeyID
CERT_GetCommonName
CERT_SaveSMimeProfile
CERT_GetDefaultCertDB
CERT_CertListFromCert
SGN_Digest
SEC_SignData
SEC_GetSignatureAlgorithmOidTag
PK11_FindKeyByAnyCert
VFY_VerifyDigestDirect
VFY_VerifyDataDirect
NSS_RegisterShutdown
HASH_GetHashObjectByOidTag
SECKEY_PublicKeyStrengthInBits
CERT_FindSMimeProfile
NSS_VersionCheck
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
PK11_GenerateRandom
PK11_HashBuf
PK11_DigestFinal
PK11_DigestOp
PK11_DigestBegin
SEC_PKCS5GetKeyLength
SEC_PKCS5GetCryptoAlgorithm
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
PK11_GetInternalSlot
PK11_ReferenceSlot
CERT_CertChainFromCert
PK11_GetInternalKeySlot
PK11_IsInternal
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_CopyEncryptedPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
SECKEY_DestroyPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
PK11_ExportPrivateKeyInfo
PK11_DestroyPBEParams
PK11_CreatePBEParams
PK11_SetSymKeyUserData
PK11_GetTokenName
PK11_TraverseCertsForSubjectInSlot
__CERT_DecodeDERCertificate
PK11_TraverseCertsForNicknameInSlot
PK11_FindKeyByDERCert
PK11_ImportDERCert
PK11_ImportCertForKeyToSlot
CERT_NewTempCertificate
CERT_IsRootDERCert
CERT_ImportCerts
PK11_ImportPublicKey
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
PK11_FindCertAndKeyByRecipientList
HASH_ResultLen
HASH_GetHashTypeByOidTag
CERT_FindCertByDERCert
CERT_VerifyCert
CERT_DestroyCertificateList
SECKEY_CopyPrivateKey
PK11_FindPrivateKeyFromCert
SECKEY_DestroyPrivateKey
CERT_FindSubjectKeyIDExtension
SECKEY_DestroySubjectPublicKeyInfo
SECKEY_CreateSubjectPublicKeyInfo
CERT_DupCertificate
NSS_Get_CERT_SetOfSignedCrlTemplate
CERT_GetCertIssuerAndSN
SECKEY_CopyPublicKey
CERT_DestroyCertificate
CERT_ExtractPublicKey
SECKEY_DestroyPublicKey
PK11_PubUnwrapSymKey
SECKEY_GetPublicKeyType
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_SetPasswordFunc
PK11_FindCertAndKeyByRecipientListNew
PK11_GetBestSlot
PK11_KeyGen
SEC_PKCS5IsAlgorithmPBEAlgTag
PK11_CreatePBEAlgorithmID
PK11_GenerateNewParam
PK11_ParamToAlgid
SEC_PKCS5IsAlgorithmPBEAlg
PK11_GetSymKeyUserData
PK11_GetPBECryptoMechanism
PK11_AlgtagToMechanism
PK11_ParamFromAlgid
PK11_GetBlockSize
PK11_GetSlotFromKey
PK11_IsHW
PK11_FreeSlot
PK11_CreateContextBySymKey
PK11_CipherOp
PK11_DestroyContext
PK11_FreeSymKey
PK11_ReferenceSymKey
PK11_GetKeyStrength
NSS_Get_CERT_TimeChoiceTemplate
CERT_NewCertList
CERT_AddCertToListTail
CERT_FilterCertListByUsage
CERT_DestroyCertArray
CERT_IsCADERCert
CERT_DestroyCertList
NSS_Get_CERT_IssuerAndSNTemplate
PK11_PBEKeyGen

nssutil3

PORT_Strdup_Util
DER_EncodeTimeChoice_Util
SECOID_CompareAlgorithmID_Util
SECITEM_ItemsAreEqual_Util
NSS_Get_sgn_DigestInfoTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
SECITEM_ZfreeItem_Util
SGN_CreateDigestInfo_Util
PORT_UCS2_ASCIIConversion_Util
SGN_DestroyDigestInfo_Util
SECITEM_CompareItem_Util
PORT_Realloc_Util
PORT_UCS2_UTF8Conversion_Util
SGN_CopyDigestInfo_Util
SEC_ASN1DecodeItem_Util
DER_GetInteger_Util
NSS_Get_SEC_BMPStringTemplate_Util
PORT_ArenaStrdup_Util
SEC_ASN1DecoderClearNotifyProc_Util
PORT_ZFree_Util
SECITEM_DupItem_Util
ATOB_ConvertAsciiToItem_Util
ATOB_AsciiToData_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1Encode_Util
DER_DecodeTimeChoice_Util
SECOID_FindOIDTag_Util
SEC_ASN1DecodeInteger_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderUpdate_Util
SECOID_DestroyAlgorithmID_Util
PORT_NewArena_Util
PORT_FreeArena_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderFinish_Util
PORT_GetError_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECITEM_AllocItem_Util
PORT_Free_Util
PORT_ZAlloc_Util
SEC_ASN1EncodeItem_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
SECOID_FindOID_Util
PORT_SetError_Util
PORT_ArenaMark_Util
SECOID_FindOIDByTag_Util
SECITEM_CopyItem_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_SetOfAnyTemplate_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
SECITEM_ArenaDupItem_Util

libplc4

PL_strncasecmp

libplds4

PL_HashTableDestroy
PL_CompareValues
PL_HashTableLookupConst
PL_HashTableAdd
PL_NewHashTable

libnspr4

PR_CallOnce
PR_NewLock
PR_Lock
PR_DestroyLock
PR_Unlock
PR_Now

msvcr90

free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
_malloc_crt
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_encode_pointer
memmove
strchr
memset
memcpy
__CppXcptFilter

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_GetVersion
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSContentInfo_SetDontStream
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSSignerInfo_Verify
NSS_CMSType_RegisterContentType
NSS_CMSUtil_VerificationStatusToString
NSS_Get_NSSCMSGenericWrapperDataTemplate
NSS_Get_NSS_PointerToCMSGenericWrapperDataTemplate
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_CreateMSSMIMEEncKeyPrefs
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddCertOrChainAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DecryptionAllowed
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifyDetachedSignatureAtTime
SEC_PKCS7VerifySignature

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/softokn3.dll
.dll .ps1 windows:5 windows x86 arch:x86 polyglot

3926cdf25d4f10ec170079b80f7ba563

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sqlite3

sqlite3_bind_text
sqlite3_bind_int
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_column_int
sqlite3_prepare_v2
sqlite3_bind_blob
sqlite3_reset
sqlite3_finalize
sqlite3_open
sqlite3_busy_timeout
sqlite3_close
sqlite3_exec
sqlite3_mprintf
sqlite3_file_control
sqlite3_free

nssutil3

SECITEM_CompareItem_Util
NSSUTIL_ArgGetLabel
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgIsBlank
NSSUTIL_ArgStrip
NSSUTIL_ArgFetchValue
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgHasFlag
_NSSUTIL_EvaluateConfigDir
PORT_Strdup_Util
SECOID_FindOIDByMechanism
_SGN_VerifyPKCS1DigestInfo
SGN_CreateDigestInfo_Util
DER_Encode_Util
SGN_DestroyDigestInfo_Util
UTIL_SetForkState
SECOID_Shutdown
SECOID_Init
SECITEM_HashCompare
NSSUTIL_DoModuleDBFunction
PORT_GetError_Util
_NSSUTIL_GetSecmodName
DER_SetUInteger
PORT_ArenaAlloc_Util
NSS_Get_SEC_OctetStringTemplate_Util
SEC_QuickDERDecodeItem_Util
PORT_ArenaGrow_Util
PORT_Realloc_Util
SECOID_GetAlgorithmTag_Util
SEC_ASN1DecodeItem_Util
DER_GetInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SECOID_SetAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECITEM_DupItem_Util
SECITEM_AllocItem_Util
PORT_ZFree_Util
SECITEM_ZfreeItem_Util
PORT_ZAlloc_Util
SECITEM_FreeItem_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
SECITEM_CopyItem_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_SetError_Util
PORT_Alloc_Util
PORT_Free_Util
PORT_FreeArena_Util

libplc4

PL_strncasecmp
PL_strcasecmp

libplds4

PL_HashTableAdd
PL_NewHashTable
PL_HashTableLookupConst
PL_HashTableDestroy
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableEnumerateEntries
PL_CompareValues

libnspr4

PR_CallOnce
PR_SetError
PR_Free
PR_smprintf
PR_NewMonitor
PR_DestroyMonitor
PR_Now
PR_EnterMonitor
PR_GetCurrentThread
PR_ExitMonitor
PR_MillisecondsToInterval
PR_IntervalNow
PR_Access
PR_SecondsToInterval
PR_NewLock
PR_Sleep
PR_smprintf_free
PR_DestroyLock
PR_FindFunctionSymbol
PR_UnloadLibrary
PR_Lock
PR_Unlock
PR_GetLibraryFilePathname
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_GetEnv
PR_snprintf

msvcr90

_chmod
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
malloc
free
getenv
sprintf
memcpy
strrchr
atoi
isdigit
islower
isupper
memset

kernel32

IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
GetTempPathA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/sqlite3.dll
.dll windows:5 windows x86 arch:x86

999e6953b3230df7248766f5074bf74c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
strncmp
memmove
realloc
malloc
memset
memcpy
free
_localtime64_s

kernel32

HeapReAlloc
GetCurrentThreadId
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileW
CreateFileMappingA
CreateFileMappingW
CreateMutexW
DeleteFileA
DeleteFileW
FlushFileBuffers
FormatMessageA
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
WaitForSingleObject
WriteFile
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
Sleep
SetFilePointer
SetEndOfFile
ReadFile
QueryPerformanceCounter
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
LoadLibraryA
HeapValidate
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExA
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddress
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_load_extension
sqlite3_malloc
sqlite3_mprintf
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_realloc
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_step
sqlite3_thread_cleanup
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vmprintf
sqlite3_wal_checkpoint

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert/ssl3.dll
.dll windows:4 windows x86 arch:x86

498d1e8cf8af9f696cb1c2696df4c8f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

CERT_DistNamesFromCertList
CERT_DupDistNames
CERT_GetDefaultCertDB
CERT_FreeNicknames
CERT_CheckCertValidTimes
PK11_GetMechanism
PK11_FindKeyByAnyCert
CERT_FindUserCertByUsage
CERT_FindCertByName
PK11_WrapSymKey
PK11_GetKeyData
CERT_DestroyCertificate
PK11_VerifyKeyOK
PK11_ReferenceSymKey
PK11_GetBestKeyLength
PK11_SaveContextAlloc
PK11_DigestKey
PK11_RestoreContext
PK11_CreateDigestContext
PK11_Derive
PK11_GetSlotFromKey
PK11_ReferenceSlot
PK11_SymKeyFromHandle
SECMOD_LookupSlot
PK11_IsPresent
PK11_GetSlotSeries
PK11_GetSlotID
PK11_GetModuleID
PK11_NeedLogin
PK11_IsLoggedIn
PK11_SignWithSymKey
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_CreateContextBySymKey
PK11_IVFromParam
PK11_CipherOp
PK11_ParamFromIV
PK11_DestroyContext
PK11_HashBuf
SECKEY_SignatureLen
DSAU_DecodeDerSig
PK11_Verify
PK11_SignatureLen
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_MapSignKeyType
SECKEY_CopyPrivateKey
SECKEY_CacheStaticFlags
CERT_DupCertList
CERT_GetSSLCACerts
CERT_FreeDistNames
PK11_Finalize
NSS_RegisterShutdown
NSS_VersionCheck
VFY_CreateContext
VFY_Begin
VFY_Update
VFY_End
VFY_DestroyContext
SGN_NewContext
SGN_Begin
SGN_Update
SGN_End
SGN_DestroyContext
PK11_PubEncryptRaw
PK11_PubDecryptRaw
PK11_GetBestSlot
__PK11_CreateContextByRawKey
HASH_GetHashObject
CERT_CacheOCSPResponseFromSideChannel
CERT_VerifyCert
CERT_VerifyCertName
CERT_NameToAscii
CERT_NewTempCertificate
SECKEY_UpdateCertPQG
CERT_CertChainFromCert
PK11_UnwrapSymKeyWithFlags
PK11_ImportSymKey
CERT_DupCertificate
PK11_GetSlotFromPrivateKey
SECKEY_PublicKeyStrengthInBits
SECKEY_CreateDHPrivateKey
PK11_PubDerive
PK11_GetInternalSlot
CERT_DestroyCertificateList
SECKEY_CreateRSAPrivateKey
SECKEY_DestroyPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetWrapKey
PK11_GetBestWrapMechanism
PK11_FreeSymKey
PK11_SetWrapKey
PK11_Sign
DSAU_EncodeDerSigWithLen
PK11_GenerateRandom
PK11_TokenExists
CERT_ExtractPublicKey
SECKEY_GetPrivateKeyType
PK11_GetPrivateModulusLen
PK11_GetBestSlotMultiple
PK11_KeyGen
PK11_FreeSlot
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_PrivDecryptPKCS1
PK11_PubUnwrapSymKey
SECKEY_DestroyPublicKey
PK11_DeriveWithFlags
PK11_ExtractKeyValue
CERT_GetCertNicknames

nssutil3

SECITEM_DupItem_Util
DER_Lengths_Util
NSSRWLock_New_Util
SECITEM_DupArray
NSSRWLock_Destroy_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
NSS_PutEnv_Util
SECITEM_Hash
SECOID_GetAlgorithmTag_Util
PORT_Realloc_Util
SECITEM_AllocItem_Util
SECITEM_ZfreeItem_Util
SECITEM_AllocArray
SECITEM_FreeArray
NSS_SecureMemcmp
PORT_ArenaAlloc_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
SECITEM_CopyItem_Util
SECITEM_CompareItem_Util
PORT_GetError_Util
NSSRWLock_LockWrite_Util
NSSRWLock_UnlockWrite_Util
NSSRWLock_LockRead_Util
NSSRWLock_UnlockRead_Util
PORT_ZFree_Util
PORT_ZAlloc_Util
PORT_Free_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
PORT_SetError_Util
PORT_Strdup_Util

libplc4

PL_strdup

libnspr4

PR_FindFunctionSymbol
PR_UnloadLibrary
PR_GetLibraryFilePathname
PR_Free
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_Close
PR_NewMonitor
PR_CreateIOLayerStub
PR_PushIOLayer
PR_GetUniqueIdentity
PR_GetDefaultIOMethods
PR_GetSocketOption
PR_ConvertIPv4AddrToIPv6
PR_DestroyMonitor
PR_GetIdentitiesLayer
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_ImportFileMapFromString
PR_ExportFileMapAsString
PR_smprintf
PR_OpenAnonFileMap
PR_smprintf_free
PR_MemMap
PR_MemUnmap
PR_CloseFileMap
PR_StringToNetAddr
PR_CallOnceWithArg
PR_CallOnce
PR_ErrorInstallTable
PR_PopIOLayer
PR_Now
PR_GetCurrentThread
PR_Sleep
PR_GetError
PR_SetError
PR_NewLock
PR_Lock
PR_Unlock
PR_DestroyLock
PR_EnterMonitor
PR_ExitMonitor
PR_MillisecondsToInterval
PR_IntervalNow
PR_GetEnv

msvcr80

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_decode_pointer
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_encoded_null
memcpy
memset
memmove
_getpid
fflush
fwrite
strstr
_time64
strchr
getenv
fputs
ftell
fopen
strrchr
malloc
free
_encode_pointer
_malloc_crt

kernel32

GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
GetLastError
GetSystemTimeAsFileTime

Exports

Exports

DTLS_GetHandshakeTimeout
DTLS_ImportFD
NSSSSL_GetVersion
NSSSSL_VersionCheck
NSS_CmpCertChainWCANames
NSS_FindCertKEAType
NSS_GetClientAuthData
NSS_SetDomesticPolicy
NSS_SetExportPolicy
NSS_SetFrancePolicy
SSL_AuthCertificate
SSL_AuthCertificateComplete
SSL_AuthCertificateHook
SSL_BadCertHook
SSL_CanBypass
SSL_CertDBHandleSet
SSL_CipherPolicyGet
SSL_CipherPolicySet
SSL_CipherPrefGet
SSL_CipherPrefGetDefault
SSL_CipherPrefSet
SSL_CipherPrefSetDefault
SSL_ClearSessionCache
SSL_ConfigMPServerSIDCache
SSL_ConfigSecureServer
SSL_ConfigSecureServerWithCertChain
SSL_ConfigServerSessionIDCache
SSL_ConfigServerSessionIDCacheWithOpt
SSL_DataPending
SSL_ExportKeyingMaterial
SSL_ForceHandshake
SSL_ForceHandshakeWithTimeout
SSL_GetChannelInfo
SSL_GetCipherSuiteInfo
SSL_GetClientAuthDataHook
SSL_GetImplementedCiphers
SSL_GetMaxServerCacheLocks
SSL_GetNegotiatedHostInfo
SSL_GetNextProto
SSL_GetNumImplementedCiphers
SSL_GetSRTPCipher
SSL_GetSessionID
SSL_GetStatistics
SSL_HandshakeCallback
SSL_HandshakeNegotiatedExtension
SSL_ImplementedCiphers
SSL_ImportFD
SSL_InheritMPServerSIDCache
SSL_InvalidateSession
SSL_LocalCertificate
SSL_NumImplementedCiphers
SSL_OptionGet
SSL_OptionGetDefault
SSL_OptionSet
SSL_OptionSetDefault
SSL_PeerCertificate
SSL_PeerStapledOCSPResponses
SSL_PreencryptedFileToStream
SSL_PreencryptedStreamToFile
SSL_ReHandshake
SSL_ReHandshakeWithTimeout
SSL_ReconfigFD
SSL_ResetHandshake
SSL_RestartHandshakeAfterCertReq
SSL_RestartHandshakeAfterServerCert
SSL_RevealCert
SSL_RevealPinArg
SSL_RevealURL
SSL_SNISocketConfigHook
SSL_SecurityStatus
SSL_SetMaxServerCacheLocks
SSL_SetNextProtoCallback
SSL_SetNextProtoNego
SSL_SetPKCS11PinArg
SSL_SetSRTPCiphers
SSL_SetSockPeerID
SSL_SetStapledOCSPResponses
SSL_SetTrustAnchors
SSL_SetURL
SSL_ShutdownServerSessionIDCache
SSL_VersionRangeGet
SSL_VersionRangeGetDefault
SSL_VersionRangeGetSupported
SSL_VersionRangeSet
SSL_VersionRangeSetDefault

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x64/TKCtrl2k64.sys
.sys windows:6 windows x64 arch:x64

259b5a43f6cc111337444a7d5f8e265d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:78:07:7a:a2:9a:9c:e5:11:c9:c5:90:30:c0:1f:5d:36:1a:db:d4:bb:d3:62:f9:76:8b:29:09:9e:8f:02:2b
Signer

Actual PE Digest

27:78:07:7a:a2:9a:9c:e5:11:c9:c5:90:30:c0:1f:5d:36:1a:db:d4:bb:d3:62:f9:76:8b:29:09:9e:8f:02:2b

Digest Algorithm

sha256

PE Digest Matches

true

8d:41:81:c7:72:19:62:5f:d0:08:3f:6e:c4:fc:b8:88:02:16:36:d8
Signer

Actual PE Digest

8d:41:81:c7:72:19:62:5f:d0:08:3f:6e:c4:fc:b8:88:02:16:36:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\users\inca-dev\jenkin~1\jobs\engdev~1\worksp~1\trunk\bin\free\amd64\TKCtrl2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
RtlInitAnsiString
PsSetCreateThreadNotifyRoutine
IoIs32bitProcess
ZwQuerySystemInformation
PsSetCreateProcessNotifyRoutine
ZwUnloadDriver
PsCreateSystemThread
IoGetCurrentProcess
ExEventObjectType
ZwClose
IoUnregisterPlugPlayNotification
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
DbgPrint
ExReleaseFastMutex
ExAcquireFastMutex
PsLookupProcessByProcessId
_wcsnicmp
ZwQueryObject
KeUnstackDetachProcess
ObQueryNameString
ZwCreateFile
wcsrchr
PsTerminateSystemThread
NtClose
ObfReferenceObject
MmIsAddressValid
ZwSetInformationObject
ZwWriteFile
KeStackAttachProcess
KeReleaseSpinLock
ExInterlockedInsertTailList
KeAcquireSpinLockRaiseToDpc
ZwOpenDirectoryObject
ZwQueryDirectoryObject
strrchr
KeSetTargetProcessorDpc
KeQueryActiveProcessors
KeInitializeDpc
ZwSetInformationFile
KeInsertQueueDpc
ZwDeleteFile
ZwOpenFile
ZwQueryInformationFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
KeWaitForMultipleObjects
PsLookupThreadByThreadId
_wcsicmp
KeBugCheckEx
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
_stricmp
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
IoGetBaseFileSystemDeviceObject
KeLeaveCriticalRegion
ObOpenObjectByName
ExInitializeNPagedLookasideList
ZwQuerySymbolicLinkObject
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlUnicodeStringToAnsiString
ZwDeleteValueKey
ExpInterlockedPopEntrySList
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
IoDriverObjectType
MmMapLockedPagesSpecifyCache
ExReleaseResourceLite
IofCompleteRequest
ExQueryDepthSList
RtlFreeAnsiString
PsGetVersion
ExDeleteResourceLite
ExInitializeResourceLite
ExDeleteNPagedLookasideList
IoAllocateMdl

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x64/TKFWFV.inf
coredll/network/x64/TKFWFV64.cat
coredll/network/x64/TKFWFV64.sys
.sys windows:6 windows x64 arch:x64

282629e63807b64dc1b2081f6cf30782

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d4:2e:3c:3c:e2:70:e2:c7:98:4f:88:18:d2:6e:3b:d6:b2:a4:37:e7
Signer

Actual PE Digest

d4:2e:3c:3c:e2:70:e2:c7:98:4f:88:18:d2:6e:3b:d6:b2:a4:37:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\svn\engdev~2\branches\if1_rb~3.01\bin\free\amd64\TKFWFV64.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
ExFreePoolWithTag
ExAllocatePoolWithTag
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
MmMapLockedPagesSpecifyCache
IoDeleteDevice
IoRegisterShutdownNotification
IoDeleteSymbolicLink
KeAcquireSpinLockRaiseToDpc
KeAcquireSpinLockAtDpcLevel
ObfReferenceObject
PsRemoveLoadImageNotifyRoutine
KeReleaseSpinLockFromDpcLevel
KeReleaseSpinLock
RtlInitUnicodeString
ObfDereferenceObject
ObReferenceObjectByHandle
ZwClose
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
PsSetCreateProcessNotifyRoutine
KeSetPriorityThread
PsSetLoadImageNotifyRoutine
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
_strnicmp
RtlUnicodeStringToAnsiString
IoGetCurrentProcess
RtlFreeAnsiString
PsGetVersion
RtlQueryRegistryValues
__C_specific_handler

hal

KeStallExecutionProcessor

ndis.sys

NdisFSendNetBufferLists
NdisOpenConfigurationEx
NdisAllocateCloneOidRequest
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisFDevicePnPEventNotify
NdisFOidRequestComplete
NdisFOidRequest
NdisFIndicateStatus
NdisFCancelOidRequest
NdisFSetAttributes
NdisFCancelSendNetBufferLists
NdisFDeregisterFilterDriver
NdisFreeMemory
NdisSetEvent
NdisAllocateMemoryWithTagPriority
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisFSendNetBufferListsComplete
NdisFreeNetBufferList
NdisFreeMdl
NdisFRegisterFilterDriver
NdisFreeCloneOidRequest
NdisFNetPnPEvent
NdisCloseConfiguration

fwpkclnt.sys

FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpmCalloutAdd0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsCalloutUnregisterById0
FwpmEngineClose0

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x64/TKIdsVt64.sys
.sys windows:6 windows x64 arch:x64

f223952fe7523417e724364b7f82853c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\en800b~1\worksp~1\trunk\bin\free\amd64\TKIdsVt64.pdb

Imports

ntoskrnl.exe

memchr
DbgPrint
KeInitializeMutex
KeInitializeEvent
PsGetCurrentProcessId
ObfDereferenceObject
IoFreeWorkItem
IoAllocateWorkItem
IoQueueWorkItem
strncmp
KeReleaseMutex
strncpy
KeWaitForSingleObject
DbgBreakPoint
islower
IoBuildDeviceIoControlRequest
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
KeBugCheckEx
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
_strnicmp
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeUnicodeString
IoGetCurrentProcess
KeAcquireSpinLockRaiseToDpc
IoAllocateMdl
IoCreateDevice
RtlCopyUnicodeString
IoCreateSymbolicLink
ObReferenceObjectByHandle
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ZwUnloadDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
KeReleaseSpinLock
IoIs32bitProcess
KeSetEvent
IoDeleteDevice
RtlInitUnicodeString
KeReadStateEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
ExAllocatePoolWithTag
MmUnmapLockedPages
__C_specific_handler

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectNetworkSendAsync0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpsCalloutRegister0
FwpmTransactionCommit0
FwpmEngineOpen0
FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineClose0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpsFreeCloneNetBufferList0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpsCalloutUnregisterById0

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x64/tkfwvt64.sys
.sys windows:6 windows x64 arch:x64

30f12997a2cd083809f9cf859612fd4b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\engdev~4\worksp~1\trunk\bin\free\amd64\tkfwvt64.pdb

Imports

ntoskrnl.exe

ZwQueryValueKey
ZwOpenKey
KeReleaseSpinLockFromDpcLevel
KeAcquireSpinLockAtDpcLevel
KeClearEvent
RtlCompareMemory
PsCreateSystemThread
PsGetCurrentThreadId
KeBugCheckEx
RtlTimeToTimeFields
ExSystemTimeToLocalTime
strncpy
ExAllocatePoolWithTag
IofCallDriver
MmIsAddressValid
ZwClose
IoGetDeviceObjectPointer
PsSetCreateProcessNotifyRoutine
IoBuildDeviceIoControlRequest
KeReleaseMutex
MmUnmapLockedPages
DbgPrint
PsGetVersion
RtlFreeAnsiString
KeQueryTimeIncrement
DbgBreakPoint
RtlUnicodeStringToAnsiString
memchr
_strnicmp
KeAcquireSpinLockRaiseToDpc
IoAllocateMdl
IoCreateDevice
ObfDereferenceObject
RtlCopyUnicodeString
PsGetCurrentProcessId
IoCreateSymbolicLink
KeWaitForSingleObject
ObReferenceObjectByHandle
IofCompleteRequest
MmMapLockedPagesSpecifyCache
KeDelayExecutionThread
ZwUnloadDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
KeAcquireInStackQueuedSpinLock
KeReleaseSpinLock
IoIs32bitProcess
KeInitializeEvent
KeSetEvent
IoDeleteDevice
RtlInitUnicodeString
KeReleaseInStackQueuedSpinLock
KeInitializeMutex
KeReadStateEvent
IoRegisterShutdownNotification
ExFreePoolWithTag
IoDeleteSymbolicLink
ProbeForRead
RtlAnsiStringToUnicodeString
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitAnsiString
ZwQuerySystemInformation
KeUnstackDetachProcess
RtlFreeUnicodeString
ObQueryNameString
IoGetCurrentProcess
KeStackAttachProcess
RtlUnicodeToMultiByteN
__C_specific_handler

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisFSendNetBufferListsComplete
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisFSendNetBufferLists
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisMSleep

fwpkclnt.sys

FwpmEngineClose0
FwpmTransactionBegin0
FwpsInjectTransportSendAsync0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpsAllocateCloneNetBufferList0
FwpmCalloutAdd0
FwpsInjectTransportReceiveAsync0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleDestroy0
FwpsFreeCloneNetBufferList0
FwpsCalloutUnregisterById0

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKCtrl2k.sys
.sys windows:6 windows x86 arch:x86

d4557be79e0f9831af3cca19a058f6a4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c3:be:a3:ca:a2:f0:9a:80:1a:66:c1:03:70:1b:6f:f8:d3:0c:bf:6f:a5:74:58:13:7b:98:f7:da:01:78:d1:e7
Signer

Actual PE Digest

c3:be:a3:ca:a2:f0:9a:80:1a:66:c1:03:70:1b:6f:f8:d3:0c:bf:6f:a5:74:58:13:7b:98:f7:da:01:78:d1:e7

Digest Algorithm

sha256

PE Digest Matches

true

e8:4b:2c:85:73:6a:54:14:4b:b4:8d:f6:34:47:bc:16:bb:3a:e7:26
Signer

Actual PE Digest

e8:4b:2c:85:73:6a:54:14:4b:b4:8d:f6:34:47:bc:16:bb:3a:e7:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\users\inca-dev\jenkin~1\jobs\engdev~1\worksp~1\trunk\bin\free\i386\TKCtrl2k.pdb

Imports

ntoskrnl.exe

PsGetCurrentProcessId
memcpy
KeInitializeEvent
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoUnregisterPlugPlayNotification
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
ObReferenceObjectByHandle
ExEventObjectType
ObfDereferenceObject
KeWaitForSingleObject
KeSetEvent
ZwClose
PsCreateSystemThread
_allmul
PsGetCurrentThreadId
PsThreadType
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsTerminateSystemThread
ObfReferenceObject
PsLookupProcessByProcessId
KeUnstackDetachProcess
ZwQueryObject
KeStackAttachProcess
MmIsAddressValid
IoGetCurrentProcess
ObQueryNameString
NtClose
ZwSetInformationObject
wcsrchr
ZwWriteFile
ZwCreateFile
ExfInterlockedInsertTailList
ZwQueryDirectoryObject
ZwOpenDirectoryObject
strrchr
ZwDeleteFile
ZwOpenFile
ZwSetInformationFile
ZwQueryInformationFile
KeTickCount
KeQueryActiveProcessors
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
MmGetSystemRoutineAddress
_stricmp
_wcsicmp
RtlImageDirectoryEntryToData
KeWaitForMultipleObjects
PsLookupThreadByThreadId
KeBugCheckEx
ZwQuerySystemInformation
DbgPrint
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
PsSetCreateThreadNotifyRoutine
IoRegisterPlugPlayNotification
_wcsnicmp
memset
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
ObOpenObjectByName
IoDriverObjectType
IoGetBaseFileSystemDeviceObject
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExDeleteNPagedLookasideList
PsGetVersion
_strnicmp
strncpy
RtlFreeUnicodeString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeReadStateEvent
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapLockedPages
ZwDeleteValueKey
RtlUnwind

hal

KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
ExReleaseFastMutex
ExAcquireFastMutex
KeGetCurrentIrql

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKCtrlU.dll
.dll windows:4 windows x86 arch:x86

e497af0c2978c4c2c39fccc20650b253

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

45:68:1f:93:1f:aa:f1:06:62:9f:72:93:94:10:c0:28:d5:c8:4d:50:15:2c:01:10:a6:41:2a:32:1c:ca:fb:b8
Signer

Actual PE Digest

45:68:1f:93:1f:aa:f1:06:62:9f:72:93:94:10:c0:28:d5:c8:4d:50:15:2c:01:10:a6:41:2a:32:1c:ca:fb:b8

Digest Algorithm

sha256

PE Digest Matches

true

a5:3d:60:a0:e8:57:53:0b:02:21:c7:2d:4f:e5:06:e9:c5:e9:d5:b3
Signer

Actual PE Digest

a5:3d:60:a0:e8:57:53:0b:02:21:c7:2d:4f:e5:06:e9:c5:e9:d5:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\engdev_0902_tkctrl\trunk\dll\tkctrl\x86\releaseu\TKCtrlU.pdb

Imports

user32

MessageBoxW
PostQuitMessage

advapi32

CloseServiceHandle
LookupAccountNameW
ConvertSidToStringSidW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyW
CreateServiceW
StartServiceW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerW
RegOpenKeyA
GetUserNameA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
ConvertSidToStringSidA
LookupAccountNameA

kernel32

CompareStringW
EnterCriticalSection
CompareStringA
OutputDebugStringW
DeviceIoControl
GetLastError
GetSystemDirectoryW
LocalFree
FormatMessageW
GetProcAddress
LoadLibraryW
GetVolumeInformationW
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
ReadFile
GetQueuedCompletionStatus
CloseHandle
GetSystemInfo
TerminateThread
ConnectNamedPipe
CreateIoCompletionPort
CreateNamedPipeW
GetCurrentProcess
CreateRemoteThread
GetModuleHandleW
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
OpenProcess
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
WriteFile
SetNamedPipeHandleState
Sleep
CreateFileW
DisconnectNamedPipe
FlushFileBuffers
ExpandEnvironmentStringsW
GetVersion
SetLastError
GetTickCount
InitializeCriticalSection
InterlockedDecrement
LeaveCriticalSection
SetEnvironmentVariableA
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
GetComputerNameA
GetWindowsDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetVersionExW
GetFileAttributesW
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetLocaleInfoW
GetTimeZoneInformation
CreateFileA

Exports

Exports

TKCtrlClose
TKCtrlCloseACI
TKCtrlCloseDataQueue
TKCtrlCloseDataQueueEx
TKCtrlCloseHandle
TKCtrlCloseNtfsFile
TKCtrlControlACI
TKCtrlControlVolumeScan
TKCtrlDeleteFile
TKCtrlDeleteFileA
TKCtrlDeleteFileW
TKCtrlEnumDirectoryObject
TKCtrlFindClose
TKCtrlFindFirstFile
TKCtrlFindFirstFileA
TKCtrlFindFirstFileQ
TKCtrlFindFirstFileQA
TKCtrlFindFirstFileQW
TKCtrlFindFirstFileW
TKCtrlFindNextFile
TKCtrlFindNextFileA
TKCtrlFindNextFileQ
TKCtrlFindNextFileQA
TKCtrlFindNextFileQW
TKCtrlFindNextFileW
TKCtrlGetAllPolicyLog
TKCtrlGetDllVersion
TKCtrlGetDrvVersion
TKCtrlGetFileSize
TKCtrlGetFileSizeEx
TKCtrlGetHiddenModule
TKCtrlGetModuleInfo
TKCtrlGetModuleList
TKCtrlGetProcessList
TKCtrlGetProcessListEx
TKCtrlHideModule
TKCtrlInit
TKCtrlInitACI
TKCtrlInitCharacterSet
TKCtrlInitDataQueue
TKCtrlInitDataQueueEx
TKCtrlLoadAtStartUp
TKCtrlLoadDriver
TKCtrlOpenFile
TKCtrlOpenFileA
TKCtrlOpenFileW
TKCtrlOpenNtfsFile
TKCtrlReadFile
TKCtrlReadNtfsFile
TKCtrlRegCloseContext
TKCtrlRegCloseKey
TKCtrlRegCreateContext
TKCtrlRegCreateContextA
TKCtrlRegCreateContextW
TKCtrlRegEnumKeyEx
TKCtrlRegEnumKeyExA
TKCtrlRegEnumKeyExW
TKCtrlRegEnumValue
TKCtrlRegEnumValueA
TKCtrlRegEnumValueW
TKCtrlRegOpenKey
TKCtrlRegOpenKeyA
TKCtrlRegOpenKeyW
TKCtrlRegQueryInfoKey
TKCtrlRegQueryInfoKeyA
TKCtrlRegQueryInfoKeyW
TKCtrlRegQueryValueEx
TKCtrlRegQueryValueExA
TKCtrlRegQueryValueExW
TKCtrlRegisterSyncThreadNotify
TKCtrlSetAppContext
TKCtrlSetPauseDataQueue
TKCtrlSetQueryInfo
TKCtrlSetQueryInfoEx
TKCtrlStartACI
TKCtrlStartVolumeScan
TKCtrlStopACI
TKCtrlUnloadDriver
TKCtrlUnregisterSyncThreadNotify

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKFW.sys
.sys windows:6 windows x86 arch:x86

6bacbf582b0e8a057bfab5b43a361842

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:8d:2d:ac:a4:46:65:54:6b:b5:87:97:81:91:a8:bf
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

31-10-2007 00:00

Not After

30-10-2017 23:59

Subject

CN=GeoTrust Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

bc:ab:62:eb:2b:36:50:c5:4b:e7:0e:3b:19:9e:a0:dc:68:8e:5f:34:f0:50:94:92:24:c1:55:8c:1c:94:e7:59
Signer

Actual PE Digest

bc:ab:62:eb:2b:36:50:c5:4b:e7:0e:3b:19:9e:a0:dc:68:8e:5f:34:f0:50:94:92:24:c1:55:8c:1c:94:e7:59

Digest Algorithm

sha256

PE Digest Matches

true

00:33:5a:0f:a8:9c:a2:87:fb:42:c4:95:1a:5a:66:89:19:f3:12:76
Signer

Actual PE Digest

00:33:5a:0f:a8:9c:a2:87:fb:42:c4:95:1a:5a:66:89:19:f3:12:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\projec~1\en005c~1\branches\if1_rb~2.01_\bin\free\i386\TKFW.pdb

Imports

ntoskrnl.exe

memset
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
KeSetEvent
KeReadStateEvent
PsGetCurrentProcessId
ExAllocatePoolWithTag
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmUnmapLockedPages
ObReferenceObjectByHandle
KeInitializeMutex
KeInitializeEvent
ObfDereferenceObject
PsGetVersion
_strnicmp
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
DbgPrint
IoGetCurrentProcess
KeQueryTimeIncrement
memcpy
_alldiv
_allmul
memchr
KeReleaseMutex
KeWaitForSingleObject
MmIsAddressValid
PsGetCurrentThreadId
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
strncpy
ZwClose
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
MmMapLockedPagesSpecifyCache
IofCompleteRequest
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
RtlCopyUnicodeString
KeTickCount
IoRegisterShutdownNotification
ObQueryNameString
PsLookupProcessByProcessId
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnwind
RtlUnicodeToMultiByteN

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKFWFV.cat
coredll/network/x86/TKFWFV.inf
coredll/network/x86/TKFWFV.sys
.sys windows:6 windows x86 arch:x86

28159e3467957b64802a7f0e2bc2727a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e0:67:1a:b8:91:5c:e2:1a:91:1b:66:f5:f4:e8:15:33:d1:97:1e:55
Signer

Actual PE Digest

e0:67:1a:b8:91:5c:e2:1a:91:1b:66:f5:f4:e8:15:33:d1:97:1e:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svn\engdev~2\branches\if1_rb~3.01\bin\free\i386\TKFWFV.pdb

Imports

ntoskrnl.exe

PsCreateSystemThread
ObReferenceObjectByHandle
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
KeGetCurrentThread
memcpy
PsTerminateSystemThread
_allmul
KeDelayExecutionThread
memset
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
IoRegisterShutdownNotification
ObfReferenceObject
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsRemoveLoadImageNotifyRoutine
RtlInitUnicodeString
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPagesSpecifyCache
IoCreateSymbolicLink
IoCreateDevice
ExFreePoolWithTag
ExAllocatePoolWithTag
KeTickCount
KeBugCheckEx
KeSetPriorityThread
RtlUnwind
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoGetCurrentProcess
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
PsGetVersion
_strnicmp
RtlQueryRegistryValues
memmove

hal

KfReleaseSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor
KfAcquireSpinLock

ndis.sys

NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFRegisterFilterDriver
NdisAllocateCloneOidRequest
NdisFIndicateReceiveNetBufferLists
NdisFSendNetBufferLists
NdisFreeCloneOidRequest
NdisFOidRequestComplete
NdisFDeregisterFilterDriver
NdisFOidRequest
NdisFCancelSendNetBufferLists
NdisFreeMdl
NdisFreeNetBufferList
NdisFSendNetBufferListsComplete
NdisFReturnNetBufferLists
NdisFNetPnPEvent
NdisFDevicePnPEventNotify
NdisFIndicateStatus
NdisFCancelOidRequest
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisFSetAttributes
NdisAllocateMemoryWithTagPriority
NdisSetEvent
NdisFreeMemory

fwpkclnt.sys

FwpsInjectionHandleCreate0
FwpmTransactionAbort0
FwpsInjectionHandleDestroy0
FwpsCalloutRegister0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmEngineClose0
FwpsCalloutUnregisterById0

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKFWU.dll
.dll windows:4 windows x86 arch:x86

ec8aeccecc6a4f3ad1b2a8c83238261c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05-05-2015 00:00

Not After

31-12-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:22:eb:94:f2:f3:e5:e3:37:b1:c1:03:6c:a6:a7:2a:f8:59:c6:c9
Signer

Actual PE Digest

c0:22:eb:94:f2:f3:e5:e3:37:b1:c1:03:6c:a6:a7:2a:f8:59:c6:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\_src\kernel\engdev_0801_tkfw\trunk\2.0\dll\tkfw\releaseu\TKFWU_dll.pdb

Imports

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupCopyOEMInfW

kernel32

FormatMessageW
OutputDebugStringW
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetSystemDirectoryW
SetEvent
GetShortPathNameW
lstrlenW
TerminateThread
GetCurrentProcessId
CreateEventW
GetCurrentProcess
VirtualFree
VirtualAlloc
DuplicateHandle
LocalFree
ReadProcessMemory
LocalAlloc
HeapFree
GetProcessHeap
lstrlenA
InterlockedDecrement
SleepEx
InterlockedIncrement
OutputDebugStringA
GetVersionExW
GetSystemInfo
CompareStringW
CompareStringA
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
WriteConsoleW
GetTickCount
Sleep
SetLastError
GetVersion
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
SetEnvironmentVariableA
GetUserDefaultLCID
EnumSystemLocalesA
OpenProcess
GetConsoleOutputCP
WriteConsoleA
SetConsoleCtrlHandler
SetStdHandle
HeapSize
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
GetFileAttributesW
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
IsValidLocale

user32

PostThreadMessageW
MessageBoxW
GetSystemMetrics
SendMessageTimeoutW
SendMessageW
wsprintfW

advapi32

LookupPrivilegeValueW
RegDeleteValueW
OpenProcessToken
AdjustTokenPrivileges
RegOpenKeyW
RegEnumKeyW
RegQueryValueExW
RegCloseKey
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize

Exports

Exports

TKFWCallbackMsgComplete
TKFWCanDoDrvUnload
TKFWClearTrafficInfo
TKFWCloseDrv
TKFWCloseDrvEx
TKFWDelAllAllowPId
TKFWDelAllBlockPId
TKFWDelAllFWCommonAllRules
TKFWDelAllFWCommonRules
TKFWDelAllIpGroup
TKFWDelAllMailExt
TKFWDelAllPortGroup
TKFWDelAllPrntSvr
TKFWDelAllProcAuth
TKFWDelAllShowShareIp
TKFWDelAllSmartStealthPId
TKFWDelAllTimeGroup
TKFWDelAllowPId
TKFWDelBlockPId
TKFWDelFWCommonRule
TKFWDelIpGroup
TKFWDelIpGroupByNum
TKFWDelMailExt
TKFWDelPortGroup
TKFWDelPortGroupByNum
TKFWDelPrntSvr
TKFWDelProcAuth
TKFWDelShowShareIp
TKFWDelSmartStealthPId
TKFWDelTimeGroup
TKFWDelTimeGroupByNum
TKFWDelTimeGroupEx
TKFWDeleteAllStaticGatewayMacs
TKFWDeleteAllSuspiciousThreads
TKFWDeleteAllWirelessWhiteListAPMacs
TKFWDeleteStaticGatewayMac
TKFWDeleteSuspiciousThread
TKFWDeleteWirelessWhiteListAPMac
TKFWGetListenStatus
TKFWGetSharedMem
TKFWGetTrafficInfo
TKFWGetVersion
TKFWInitDrv
TKFWInitDrvEx
TKFWInsAllowPId
TKFWInsBlockPId
TKFWInsFWCommonRule
TKFWInsIpGroup
TKFWInsMailExt
TKFWInsPortGroup
TKFWInsPrntSvr
TKFWInsProcAuth
TKFWInsShowShareIp
TKFWInsSmartStealthPId
TKFWInsTimeGroup
TKFWInsTimeGroupEx
TKFWInsertStaticGatewayMac
TKFWInsertSuspiciousThread
TKFWInsertWirelessWhiteListAPMac
TKFWInstallDrv
TKFWMACSpoofDetect
TKFWMACSpoofRecover
TKFWModFWCommonRule
TKFWModPrntSvr
TKFWModProcAuth
TKFWModShowShareIp
TKFWRegCallbackFunc
TKFWRegThreadCallbackMsg
TKFWReghWndCallbackMsg
TKFWSelectFWFunc
TKFWSendPkt
TKFWSetAppReady
TKFWSetExcludeProcessPathOnProcAuth
TKFWSetFWPause
TKFWSetNetworkStop
TKFWSetPolicy
TKFWSetRedirIp
TKFWSetSSNTimeOut
TKFWStopWhileNotRunning
TKFWUninstallDrv

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 524KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKIdsVt.sys
.sys windows:6 windows x86 arch:x86

0a7e0ecbd6ccb98296d7618457ac82b6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\en800b~1\worksp~1\trunk\bin\free\i386\TKIdsVt.pdb

Imports

ntoskrnl.exe

ObfDereferenceObject
IoQueueWorkItem
IoAllocateWorkItem
IoFreeWorkItem
strncmp
strncpy
KeReleaseMutex
KeWaitForSingleObject
islower
DbgBreakPoint
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
KeTickCount
KeBugCheckEx
RtlUnwind
PsGetCurrentProcessId
KeInitializeEvent
KeInitializeMutex
DbgPrint
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
memchr
IoGetCurrentProcess
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_strnicmp
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
memcpy
MmMapLockedPagesSpecifyCache
KeReadStateEvent
KeSetEvent
ZwUnloadDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
ExFreePoolWithTag
memset
ExAllocatePoolWithTag
RtlCopyUnicodeString

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpmEngineClose0
FwpsAllocateCloneNetBufferList0
FwpsFreeCloneNetBufferList0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmSubLayerAdd0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpsInjectionHandleCreate0
FwpsCalloutRegister0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsInjectNetworkSendAsync0

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/tkfwflt.sys
.sys windows:5 windows x86 arch:x86

9d97e8586178e7df479db7cdd3c6831d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:37:04:4b:6d:a5:69:f4:65:77:47:12:e2:de:a7:84:41:29:6b:93
Signer

Actual PE Digest

9a:37:04:4b:6d:a5:69:f4:65:77:47:12:e2:de:a7:84:41:29:6b:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\PROJEC~2\EN8FAA~1\branches\IF1_RB~3.01_\bin\free\i386\tkfwflt.pdb

Imports

ntoskrnl.exe

KeGetCurrentThread
ZwClose
islower
strncmp
RtlInitString
_wcsnicmp
KeWaitForSingleObject
_stricmp
MmIsAddressValid
MmBuildMdlForNonPagedPool
IoAllocateMdl
RtlCompareMemory
IoFreeMdl
IofCallDriver
MmMapLockedPages
KeSetEvent
KeReadStateEvent
ObReferenceObjectByHandle
PsCreateSystemThread
PsTerminateSystemThread
KeSetPriorityThread
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
MmProbeAndLockPages
IoAllocateIrp
IoGetRelatedDeviceObject
IoFreeIrp
MmUnlockPages
IoGetCurrentProcess
_strnicmp
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
ExAllocatePoolWithTag
memmove
RtlQueryRegistryValues
ExFreePool
PsGetVersion
PsGetCurrentProcessId
ObfReferenceObject
ObfDereferenceObject
KeInitializeSpinLock
KeInitializeEvent
IoCreateDevice
IoCreateSymbolicLink
MmMapLockedPagesSpecifyCache
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
IoRegisterShutdownNotification
ZwQuerySystemInformation
DbgPrint

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

ndis.sys

NdisAllocateMemory
NdisAllocatePacketPool
NdisAllocateBufferPool
NdisFreePacketPool
NdisCloseAdapter
NdisAllocateMemoryWithTag
NdisRegisterProtocol
NdisUnchainBufferAtFront
NdisAllocatePacket
NdisAllocateBuffer
NdisFreeMemory
NdisFreePacket
NdisOpenAdapter

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/tkfwfltU.dll
.dll windows:4 windows x86 arch:x86

705ded5385fdf03f707bae3ec273afa7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:3d:21:b4:cf:3d:af:15:22:6e:b1:2e:f2:3c:54:54:a8:d7:06:28
Signer

Actual PE Digest

a4:3d:21:b4:cf:3d:af:15:22:6e:b1:2e:f2:3c:54:54:a8:d7:06:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\TKFWFLT\branches\IF1_RB-2012.01.05.01\Dll\tkfwflt\ReleaseU\tkfwfltU_dll.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

GetSystemInfo
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetSystemDirectoryW
GetVersionExW
GetCurrentProcessId
ReleaseMutex
GetCurrentProcess
InterlockedIncrement
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
CompareStringA
CreateFileA
GetTimeZoneInformation
OutputDebugStringW
FormatMessageW
LocalFree
GetTickCount
Sleep
SetLastError
GetVersion
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
CompareStringW
CreateMutexW
GetModuleHandleA
GetLocaleInfoW
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle

user32

wsprintfW
MessageBoxW

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
RegOpenKeyExW

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Exports

Exports

TKFWFLTCloseDrv
TKFWFLTGetVersion
TKFWFLTInitDrv
TKFWFLTIsDrvLoaded
TKFWFLTIsDrvReady
TKFWFLTLoadAtStartUp
TKFWFLTModPktHdr
TKFWFLTSetAppReady
TKFWFLTSetNetworkStop
TKFWFVInstallNLoadDrv
TKFWFVInstallNLoadDrvEx
TKFWFVIsDrvLoaded
TKFWFVUninstallNUnLoadDrv
TKFWFVUninstallNUnLoadDrvEx

Sections

.text
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 265B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/tkfwvt.sys
.sys windows:6 windows x86 arch:x86

11888564d7c6364446e49e59922c633c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\engdev~4\worksp~1\trunk\bin\free\i386\tkfwvt.pdb

Imports

ntoskrnl.exe

KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsCreateSystemThread
PsGetCurrentThreadId
KeClearEvent
KeBugCheckEx
RtlUnwind
ZwOpenKey
ZwQueryValueKey
strncpy
KeQuerySystemTime
ExSystemTimeToLocalTime
RtlTimeToTimeFields
ExAllocatePoolWithTag
RtlCompareMemory
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
PsSetCreateProcessNotifyRoutine
IoRegisterShutdownNotification
ZwClose
MmIsAddressValid
KeReleaseMutex
DbgBreakPoint
memchr
_allmul
_alldiv
KeTickCount
KeQueryTimeIncrement
DbgPrint
_strnicmp
PsGetVersion
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeMutex
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
KeInitializeEvent
PsGetCurrentProcessId
KeReadStateEvent
ZwUnloadDriver
memcpy
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeDelayExecutionThread
KeSetEvent
KeWaitForSingleObject
ObfDereferenceObject
memset
RtlCopyUnicodeString
ObQueryNameString
IoGetCurrentProcess
PsLookupProcessByProcessId
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnicodeToMultiByteN

hal

KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisFSendNetBufferListsComplete
NdisFSendNetBufferLists

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpmEngineClose0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsCalloutRegister0
FwpsFreeCloneNetBufferList0
FwpsAllocateCloneNetBufferList0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleCreate0

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/tkids.sys
.sys windows:6 windows x86 arch:x86

46956ab5c9fcc3e59373f44c449e4a43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:11:c6:eb:e4:f5:e1:34:2c:a9:12:1b:1c:d9:6d:4e:dc:9f:ed:4d
Signer

Actual PE Digest

52:11:c6:eb:e4:f5:e1:34:2c:a9:12:1b:1c:d9:6d:4e:dc:9f:ed:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\projec~1\en800b~1\branches\if1_rb~3.01_\bin\free\i386\tkids.pdb

Imports

ntoskrnl.exe

MmMapLockedPagesSpecifyCache
memcpy
memset
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
KeSetEvent
KeReadStateEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmUnmapLockedPages
ObReferenceObjectByHandle
KeInitializeMutex
KeInitializeEvent
PsGetCurrentProcessId
ObfDereferenceObject
_strnicmp
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
PsGetVersion
IofCompleteRequest
islower
memchr
strncmp
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
strncpy
KeReleaseMutex
KeWaitForSingleObject
RtlQueryRegistryValues
memmove
ZwClose
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
RtlInitUnicodeString
IoDeleteSymbolicLink
IoRegisterShutdownNotification
IoDeleteDevice
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlCopyUnicodeString
KeTickCount
MmIsAddressValid
ObQueryNameString
IoGetCurrentProcess
PsLookupProcessByProcessId
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnwind
DbgPrint
RtlUnicodeToMultiByteN

hal

KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/tkidsxU.dll
.dll windows:4 windows x86 arch:x86

95b858b1f54e093e088ccc59c7be20fa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:c3:ea:06:e2:c3:73:67:08:63:ae:69:5a:52:bb:91:84:2e:9b:e3
Signer

Actual PE Digest

08:c3:ea:06:e2:c3:73:67:08:63:ae:69:5a:52:bb:91:84:2e:9b:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\TKIDS\branches\IF1_RB-2012.01.09.01\Dll\tkidsx\ReleaseU\tkidsxU.pdb

Imports

setupapi

SetupCopyOEMInfW

ws2_32

ntohl
ntohs

kernel32

GetTickCount
LocalFree
FormatMessageW
FreeLibrary
GetProcAddress
LoadLibraryW
OutputDebugStringW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetSystemDirectoryW
SetEvent
TerminateThread
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateEventW
GetCurrentProcess
Sleep
VirtualAlloc
DuplicateHandle
OpenProcess
ReadProcessMemory
LocalAlloc
HeapFree
GetProcessHeap
InterlockedDecrement
SleepEx
InterlockedIncrement
GetVersionExW
GetSystemInfo
GetModuleHandleW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetLastError
GetVersion
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
CreateFileA
GetTimeZoneInformation
CompareStringA
CompareStringW
VirtualFree
EnterCriticalSection
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
SetEnvironmentVariableA
LeaveCriticalSection
GetModuleHandleA
ExitProcess
HeapReAlloc
GetFileAttributesW
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
GetCommandLineA
GetVersionExA
SetConsoleCtrlHandler
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
FatalAppExitA
HeapDestroy
HeapCreate
TerminateProcess
IsDebuggerPresent
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
HeapSize
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
LCMapStringA

user32

wsprintfW
MessageBoxW
PostThreadMessageW
SendMessageW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
OpenProcessToken

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize

Exports

Exports

TKIDSBuildIDSRule
TKIDSCallbackMsgComplete
TKIDSCanDoDrvUnload
TKIDSCloseDrv
TKIDSCloseDrvEx
TKIDSDelAPValue
TKIDSDelAllAPValue
TKIDSDelAllAllowPId
TKIDSDelAllAntiDDosIp
TKIDSDelAllBlockPId
TKIDSDelAllIDSRules
TKIDSDelAllNoLogPId
TKIDSDelAllPCSiteAllInfos
TKIDSDelAllPCSiteInfo
TKIDSDelAllowPId
TKIDSDelAntiDDosIp
TKIDSDelBlockPId
TKIDSDelNoLogPId
TKIDSDelPCSiteInfo
TKIDSDeleteAllAntiDDosExceptProcess
TKIDSDeleteAntiDDosExceptProcess
TKIDSGetVersion
TKIDSInitDrv
TKIDSInitDrvEx
TKIDSInsAPValue
TKIDSInsAllowPId
TKIDSInsAntiDDosIp
TKIDSInsBlockPId
TKIDSInsIDSRule
TKIDSInsNoLogPId
TKIDSInsPCSiteInfo
TKIDSInsertAntiDDosExceptProcess
TKIDSInstallDrv
TKIDSRegCallbackFunc
TKIDSRegThreadCallbackMsg
TKIDSReghWndCallbackMsg
TKIDSRelAntiDDosIpHeaderMod
TKIDSReleaseAntiDDosInfected
TKIDSSendPkt
TKIDSSetAPAuthResult
TKIDSSetAPPolicyInfo
TKIDSSetAPUse
TKIDSSetAntiDDosIpHeaderMod
TKIDSSetAppReady
TKIDSSetExtraPolicy
TKIDSSetIDSPause
TKIDSSetPCAuthResult
TKIDSSetPCPolicyInfo
TKIDSSetPCUse
TKIDSUninstallDrv

Sections

.text
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/tknetcfg.exe
.exe windows:4 windows x86 arch:x86

cffbd3ad773e8cc9d466bf9b0e5392d6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

69:b9:b1:8d:6c:dd:19:21:9d:d1:a0:5a:49:d6:8d:97:4c:75:db:b2
Signer

Actual PE Digest

69:b9:b1:8d:6c:dd:19:21:9d:d1:a0:5a:49:d6:8d:97:4c:75:db:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\SVN\ENGDEV_0803_TKFWFLT\branches\IF1_RB-2010.03.16.01\App\TKNetCfg\Release\Win32\tknetcfg.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

SetLastError
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
CopyFileW
DeleteFileW
OutputDebugStringW
GetLastError
FormatMessageW
LocalFree
CloseHandle
CreateFileA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
HeapSize

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
coredll/network/x86/tknetcfg64.exe
.exe windows:4 windows x64 arch:x64

faa7f8783341e73f56ccaa861494179f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:3f:5e:6c:e8:6b:5e:55:78:c9:3a:09:0d:94:7b:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-11-2009 00:00

Not After

01-12-2010 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

68:32:a6:ab:eb:de:77:c3:63:55:72:23:46:23:89:35:45:d2:1f:c2
Signer

Actual PE Digest

68:32:a6:ab:eb:de:77:c3:63:55:72:23:46:23:89:35:45:d2:1f:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\SVN\ENGDEV_0803_TKFWFLT\branches\IF1_RB-2010.03.16.01\App\TKNetCfg\x64\Release\tknetcfg64.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

FlsSetValue
GetSystemDirectoryW
GetCurrentDirectoryW
CopyFileW
DeleteFileW
GetWindowsDirectoryW
OutputDebugStringW
GetLastError
FormatMessageW
LocalFree
CloseHandle
CreateFileA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FlsGetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapReAlloc
FlushFileBuffers
HeapSize

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
coredll/protect/dll/TKFsAvMU.dll
.dll windows:4 windows x86 arch:x86

e4778084b51abbc495cb879793f9b094

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:a5:d8:1b:c9:cc:f8:71:59:c5:e9:e1:5a:c4:9e:88:fa:81:55:03:15:a2:29:97:7c:3e:73:74:35:cb:a3:4d
Signer

Actual PE Digest

32:a5:d8:1b:c9:cc:f8:71:59:c5:e9:e1:5a:c4:9e:88:fa:81:55:03:15:a2:29:97:7c:3e:73:74:35:cb:a3:4d

Digest Algorithm

sha256

PE Digest Matches

true

a5:94:a7:69:be:57:ac:cd:b8:86:a6:d1:30:1c:c4:5f:62:eb:c2:d3
Signer

Actual PE Digest

a5:94:a7:69:be:57:ac:cd:b8:86:a6:d1:30:1c:c4:5f:62:eb:c2:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Jenkins\jobs\ENGDEV_0609_TKFSAV\workspace\trunk\dll\TKFsAvM\x86\ReleaseU\TKFsAvMU.pdb

Imports

kernel32

DeviceIoControl
GetLastError
GetVersion
SetLastError
GetTickCount
GetProcAddress
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
GetSystemInfo
GetVersionExW
lstrlenW
CompareStringW
CompareStringA
GetTimeZoneInformation
ResetEvent
SetEvent
TerminateThread
Sleep
GetShortPathNameW
FormatMessageW
LocalFree
GetSystemDirectoryW
CreateFileW
SetFilePointer
WriteFile
CloseHandle
WaitForSingleObject
GetCurrentThreadId
CreateEventW
ExitThread
CreateThread
GetFileAttributesW
HeapAlloc
HeapFree
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapSize
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

user32

PostQuitMessage
MessageBoxW

advapi32

RegDeleteKeyW
ControlService
QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW

Exports

Exports

TKFsAcCreateFileGroup
TKFsAcCreateLogThread
TKFsAcCreateLogThreadCtx
TKFsAcCreateProcGroup
TKFsAcCreateRule
TKFsAcCreateTimeGroupForRepeat
TKFsAcCreateTimeGroupForSpecific
TKFsAcCreateUserGroup
TKFsAcDBGQueryPolicyDB
TKFsAcDeleteGroup
TKFsAcDeleteRule
TKFsAcDeleteVolumeExcludeProc
TKFsAcInsertVolumeAllow
TKFsAcModifyFileGroup
TKFsAcModifyRule
TKFsAcPause
TKFsAcPauseLogThread
TKFsAcRemoveAllRuleDB
TKFsAcSetAntiRootkitProtect
TKFsAcSetDeleteFlagDriverService
TKFsAcSetSafeMode
TKFsAcSetVolumeExcludeProc
TKFsAcTerminateLogThread
TKFsAcVolumePause
TKFsAvClose
TKFsAvCloseScanCreateThread
TKFsAvCloseScanCreateThreadCtx
TKFsAvCloseScanTerminateThread
TKFsAvDeleteServiceReg
TKFsAvErrorAlertCreateThread
TKFsAvErrorAlertCreateThreadCtx
TKFsAvErrorAlertCreateThreadEx
TKFsAvErrorAlertCreateThreadExCtx
TKFsAvErrorAlertTerminateThread
TKFsAvFsPause
TKFsAvGetAllPolicyLog
TKFsAvGetCacheData
TKFsAvGetCacheSize
TKFsAvGetDllVersion
TKFsAvGetDrvVersion
TKFsAvInfectedCacheClear
TKFsAvInfectedCacheCreateThread
TKFsAvInfectedCacheCreateThreadCtx
TKFsAvInfectedCacheTerminate
TKFsAvInfectedCacheTerminateThread
TKFsAvInit
TKFsAvLoadAtStartUp
TKFsAvLoadDriver
TKFsAvModifyScanState
TKFsAvNwPause
TKFsAvOpenScanCreateThread
TKFsAvOpenScanCreateThreadCtx
TKFsAvOpenScanTerminateThread
TKFsAvProcessNotifyPause
TKFsAvResetOnlyHighIncludeFile
TKFsAvResetSystemExcludeFile
TKFsAvResetSystemExcludeFileInvert
TKFsAvResetSystemExcludeProc
TKFsAvResetUserCloseIncludeFile
TKFsAvResetUserCloseIncludeProc
TKFsAvResetUserExcludeFile
TKFsAvResetUserExcludeFileEx
TKFsAvResetUserExcludeProc
TKFsAvResetUserOpenIncludeFile
TKFsAvResetUserOpenIncludeProc
TKFsAvResetiCache
TKFsAvSetAllowProcessID
TKFsAvSetAvIoLevel
TKFsAvSetAvPatternUpdateCount
TKFsAvSetCacheData
TKFsAvSetDebugMod
TKFsAvSetFileIoTimeout
TKFsAvSetOnlyHighIncludeFile
TKFsAvSetResultStatus
TKFsAvSetResultStatusEx
TKFsAvSetSystemExcludeFile
TKFsAvSetSystemExcludeFileInvert
TKFsAvSetSystemExcludeProc
TKFsAvSetUserCloseIncludeFile
TKFsAvSetUserCloseIncludeProc
TKFsAvSetUserExcludeFile
TKFsAvSetUserExcludeFileEx
TKFsAvSetUserExcludeProc
TKFsAvSetUserOpenIncludeFile
TKFsAvSetUserOpenIncludeProc
TKFsAvSetiCacheMaxEntry
TKFsAvThreadNotifyPause
TKFsAvUnloadDriver
TKFsAvWaitThreadPause

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/dll/TKFsFtMU.dll
.dll windows:4 windows x86 arch:x86

02364cdbc9c8df1d47becde436bb9178

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e3:2a:4f:dd:39:8f:f9:64:c7:8d:fe:06:21:04:a2:b6:03:e7:63:7c
Signer

Actual PE Digest

e3:2a:4f:dd:39:8f:f9:64:c7:8d:fe:06:21:04:a2:b6:03:e7:63:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\engdev_0608_tkfsft_2.0\trunk\dll\tkfsftm\x86\releaseu\TKFsFtMU.pdb

Imports

kernel32

GetSystemInfo
GetVersionExW
lstrlenW
GetModuleHandleW
CompareStringW
CompareStringA
GetTimeZoneInformation
GetProcAddress
Sleep
SetLastError
GetTickCount
CloseHandle
CreateFileW
GetVersion
LocalFree
FormatMessageW
GetLastError
GetSystemDirectoryW
DeviceIoControl
GetCurrentProcess
OutputDebugStringW
GetFileAttributesW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapSize
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

user32

MessageBoxW
PostQuitMessage

advapi32

RegEnumKeyExW
RegDeleteKeyW
OpenServiceW
ControlService
QueryServiceStatus
StartServiceW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegCreateKeyExW

Exports

Exports

TKFsFtDeleteServiceReg
TKFsFtMGetDllVersion
TKFsFtMGetDrvInstance
TKFsFtMGetDrvVersion
TKFsFtMInstallDriver
TKFsFtMLoadDriver
TKFsFtMSetPause
TKFsFtMSetSafeMode
TKFsFtMUnInstallDriver
TKFsFtMUnLoadDriver

Sections

.text
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/dll/TKPcFtU.dll
.dll windows:4 windows x86 arch:x86

c3e8bc028cef08f440c89a243f10ea87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:6d:47:a4:5c:f0:64:20:45:0d:ca:76:f5:bd:c0:7c:c5:dc:b6:46:13:89:d9:76:d5:ba:78:af:33:6d:fe:d5
Signer

Actual PE Digest

c0:6d:47:a4:5c:f0:64:20:45:0d:ca:76:f5:bd:c0:7c:c5:dc:b6:46:13:89:d9:76:d5:ba:78:af:33:6d:fe:d5

Digest Algorithm

sha256

PE Digest Matches

true

13:a8:b5:25:c1:20:22:a4:a5:a9:38:76:57:28:a9:cf:b8:b2:c2:7b
Signer

Actual PE Digest

13:a8:b5:25:c1:20:22:a4:a5:a9:38:76:57:28:a9:cf:b8:b2:c2:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\engdev_0904_tkpcft_1.0\trunk\dll\tkpcft\x86\releaseu\TKPcFtU.pdb

Imports

kernel32

GetModuleHandleW
GetCurrentProcess
GetSystemInfo
GetProcAddress
CompareStringW
CompareStringA
GetTimeZoneInformation
Sleep
SetLastError
GetTickCount
CloseHandle
CreateFileW
GetVersion
GetVersionExW
LocalFree
FormatMessageW
GetLastError
GetSystemDirectoryW
DeviceIoControl
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetLocaleInfoW
IsValidLocale
GetFileAttributesW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
HeapSize
FatalAppExitA
VirtualAlloc
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
SetEnvironmentVariableA

user32

PostQuitMessage
MessageBoxW

advapi32

RegCreateKeyExW
OpenSCManagerW
DeleteService
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
CloseServiceHandle
CreateServiceW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

TKPcFtGetDllVersion
TKPcFtGetDrvVersion
TKPcFtGetHookFuncNameInfo
TKPcFtLoadAtStartUp
TKPcFtLoadDriver
TKPcFtRegisterProcessControl
TKPcFtRegisterProcessControlSSDT
TKPcFtSetPause
TKPcFtSetRegisterProcessProtect
TKPcFtSetSafeMode
TKPcFtUnloadDriver

Sections

.text
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/dll/TKRgAcu.dll
.dll windows:4 windows x86 arch:x86

afab5c4bb0975645a235b077175b885e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:47:0a:8e:05:04:34:e4:9d:00:6a:38:ca:2e:90:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

08-02-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:ac:85:d5:7c:2d:7d:85:cf:c0:13:a1:73:89:f9:b6:4f:22:8a:ac
Signer

Actual PE Digest

5d:ac:85:d5:7c:2d:7d:85:cf:c0:13:a1:73:89:f9:b6:4f:22:8a:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\engdev_0605_tkrgac_1.0\trunk\dll\tkrgac\x86\releaseu\TKRgAcU.pdb

Imports

kernel32

CreateEventW
CloseHandle
GetVersion
SetLastError
Sleep
GetTickCount
GetModuleHandleW
CreateThread
GetCurrentProcess
GetSystemInfo
GetVersionExW
CompareStringW
CompareStringA
GetTimeZoneInformation
FlushFileBuffers
CreateFileW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcessId
GetShortPathNameW
WaitForSingleObject
GetSystemDirectoryW
FormatMessageW
LocalFree
DeviceIoControl
SetEvent
OutputDebugStringW
GetFileAttributesW
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
InitializeCriticalSection
RtlUnwind
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapSize
GetLocaleInfoW
CreateFileA
SetEnvironmentVariableA

user32

MessageBoxW
PostQuitMessage
wsprintfW

advapi32

QueryServiceStatus
OpenSCManagerW
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
ControlService

Exports

Exports

TKRgAcActive
TKRgAcCLSIDPause
TKRgAcCLSIDResetExcludeProcList
TKRgAcCLSIDResetExcludeTargetList
TKRgAcCLSIDSetExcludeProcList
TKRgAcCLSIDSetExcludeTargetList
TKRgAcCLSIDSetOptions
TKRgAcCSLIDResetScanList
TKRgAcCSLIDSetScanList
TKRgAcClose
TKRgAcCreateLogThread
TKRgAcCreateMD5TypeCLSID
TKRgAcCreateProcGroup
TKRgAcCreateRegGroup
TKRgAcCreateRule
TKRgAcCreateTimeGroupForRepeat
TKRgAcCreateTimeGroupForSpecific
TKRgAcCreateUserGroup
TKRgAcCreateWildRegGroup
TKRgAcDBGQueryPolicyDB
TKRgAcDeleteGroup
TKRgAcDeleteMD5TypeCLSID
TKRgAcDeleteRule
TKRgAcGetAllPolicyLog
TKRgAcGetDllVersion
TKRgAcGetDrvVersion
TKRgAcInit
TKRgAcInitCharacterSet
TKRgAcLoadAtStartUp
TKRgAcLoadDriver
TKRgAcModifyRule
TKRgAcPauseLogThread
TKRgAcRemoveAllRuleDB
TKRgAcRulePause
TKRgAcSetAllowProcessID
TKRgAcSetAppContext
TKRgAcSetSafeMode
TKRgAcTerminateLogThread
TKRgAcUnloadDriver

Sections

.text
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/dll/TKRgFtu.dll
.dll windows:4 windows x86 arch:x86

f59d6f975f23cdc31e0ca11de1867d0d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b8:0e:5a:77:80:57:89:a6:0c:eb:ea:24:71:57:1d:3b:de:d0:95:8c:56:f0:99:2c:ea:65:e5:d9:9c:2c:2c:55
Signer

Actual PE Digest

b8:0e:5a:77:80:57:89:a6:0c:eb:ea:24:71:57:1d:3b:de:d0:95:8c:56:f0:99:2c:ea:65:e5:d9:9c:2c:2c:55

Digest Algorithm

sha256

PE Digest Matches

true

d3:2e:b4:83:7b:ba:dd:4d:e3:c5:2f:be:c1:4f:e5:5c:27:43:cf:7c
Signer

Actual PE Digest

d3:2e:b4:83:7b:ba:dd:4d:e3:c5:2f:be:c1:4f:e5:5c:27:43:cf:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Jenkins\jobs\ENGDEV_0606_TKRGFT\workspace\trunk\dll\TKRgFt\x86\ReleaseU\TKRgFtU.pdb

Imports

kernel32

GetModuleHandleW
GetCurrentProcess
GetSystemInfo
GetProcAddress
CompareStringW
CompareStringA
GetTimeZoneInformation
GetVersion
GetTickCount
Sleep
SetLastError
CloseHandle
CreateFileW
GetLastError
GetCurrentProcessId
GetSystemDirectoryW
FormatMessageW
LocalFree
DeviceIoControl
GetVersionExW
OutputDebugStringW
GetFileAttributesW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapSize
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

user32

PostQuitMessage
MessageBoxW

advapi32

OpenSCManagerW
ControlService
QueryServiceStatus
DeleteService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegDeleteKeyW

Exports

Exports

TKRgFtGetDllVersion
TKRgFtGetDrvVersion
TKRgFtLoadAtStartUp
TKRgFtLoadDriver
TKRgFtPause
TKRgFtRegisterHook
TKRgFtRegisterUnhook
TKRgFtSetObserve
TKRgFtSetOptimizeMode
TKRgFtSetSafeMode
TKRgFtUnloadDriver

Sections

.text
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKCtrl2k64.sys
.sys windows:6 windows x64 arch:x64

259b5a43f6cc111337444a7d5f8e265d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:78:07:7a:a2:9a:9c:e5:11:c9:c5:90:30:c0:1f:5d:36:1a:db:d4:bb:d3:62:f9:76:8b:29:09:9e:8f:02:2b
Signer

Actual PE Digest

27:78:07:7a:a2:9a:9c:e5:11:c9:c5:90:30:c0:1f:5d:36:1a:db:d4:bb:d3:62:f9:76:8b:29:09:9e:8f:02:2b

Digest Algorithm

sha256

PE Digest Matches

true

8d:41:81:c7:72:19:62:5f:d0:08:3f:6e:c4:fc:b8:88:02:16:36:d8
Signer

Actual PE Digest

8d:41:81:c7:72:19:62:5f:d0:08:3f:6e:c4:fc:b8:88:02:16:36:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\users\inca-dev\jenkin~1\jobs\engdev~1\worksp~1\trunk\bin\free\amd64\TKCtrl2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
RtlInitAnsiString
PsSetCreateThreadNotifyRoutine
IoIs32bitProcess
ZwQuerySystemInformation
PsSetCreateProcessNotifyRoutine
ZwUnloadDriver
PsCreateSystemThread
IoGetCurrentProcess
ExEventObjectType
ZwClose
IoUnregisterPlugPlayNotification
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
DbgPrint
ExReleaseFastMutex
ExAcquireFastMutex
PsLookupProcessByProcessId
_wcsnicmp
ZwQueryObject
KeUnstackDetachProcess
ObQueryNameString
ZwCreateFile
wcsrchr
PsTerminateSystemThread
NtClose
ObfReferenceObject
MmIsAddressValid
ZwSetInformationObject
ZwWriteFile
KeStackAttachProcess
KeReleaseSpinLock
ExInterlockedInsertTailList
KeAcquireSpinLockRaiseToDpc
ZwOpenDirectoryObject
ZwQueryDirectoryObject
strrchr
KeSetTargetProcessorDpc
KeQueryActiveProcessors
KeInitializeDpc
ZwSetInformationFile
KeInsertQueueDpc
ZwDeleteFile
ZwOpenFile
ZwQueryInformationFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
KeWaitForMultipleObjects
PsLookupThreadByThreadId
_wcsicmp
KeBugCheckEx
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
_stricmp
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
IoGetBaseFileSystemDeviceObject
KeLeaveCriticalRegion
ObOpenObjectByName
ExInitializeNPagedLookasideList
ZwQuerySymbolicLinkObject
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlUnicodeStringToAnsiString
ZwDeleteValueKey
ExpInterlockedPopEntrySList
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
IoDriverObjectType
MmMapLockedPagesSpecifyCache
ExReleaseResourceLite
IofCompleteRequest
ExQueryDepthSList
RtlFreeAnsiString
PsGetVersion
ExDeleteResourceLite
ExInitializeResourceLite
ExDeleteNPagedLookasideList
IoAllocateMdl

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKFsAv64.sys
.sys windows:6 windows x64 arch:x64

197b7cac7a0e0e10d3ba3e98fe4da126

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\project\nos-d\engdev_0609_tkfsav\trunk\2.0\bin\free\amd64\TKFsAv64.pdb

Imports

ntoskrnl.exe

IoDeleteDevice
KeSetEvent
IoIs32bitProcess
KeReleaseSpinLock
KeEnterCriticalRegion
ZwUnloadDriver
ExEventObjectType
ExReleaseResourceLite
KeInitializeSemaphore
ObReferenceObjectByHandle
PsThreadType
ExInterlockedRemoveHeadList
ExDeleteResourceLite
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
ExInitializeResourceLite
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
_wcsnicmp
PsReferencePrimaryToken
wcsncat
IoGetDeviceObjectPointer
IoGetCurrentProcess
ZwClose
wcsncmp
ZwQueryInformationToken
RtlInitUnicodeString
KeStackAttachProcess
IofCallDriver
ExFreePoolWithTag
KeInitializeEvent
ExInterlockedInsertTailList
KeReadStateEvent
KeUnstackDetachProcess
KeWaitForSingleObject
KeReleaseSemaphore
DbgPrint
ZwCreateFile
_vsnprintf
ZwWriteFile
towlower
wcsrchr
ExAcquireResourceSharedLite
IoThreadToProcess
PsProcessType
PsLookupProcessByProcessId
ZwQueryObject
ZwQuerySystemInformation
ZwOpenProcess
MmIsAddressValid
PsCreateSystemThread
PsTerminateSystemThread
ZwTerminateProcess
MmUnmapViewOfSection
ObQueryNameString
IoFileObjectType
KeBugCheckEx
KeLeaveCriticalRegion
KeResetEvent
IoDeleteSymbolicLink
ObOpenObjectByPointer
ExAcquireResourceExclusiveLite
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
_stricmp
_strnicmp
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
RtlConvertSidToUnicodeString
strncmp
RtlAnsiStringToUnicodeString
ObOpenObjectByName
ExInitializeNPagedLookasideList
ZwQuerySymbolicLinkObject
PsReferenceImpersonationToken
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ExpInterlockedPopEntrySList
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
RtlFreeUnicodeString
strncpy
IoDriverObjectType
MmMapLockedPagesSpecifyCache
ExSystemTimeToLocalTime
ZwQueryValueKey
IofCompleteRequest
ExQueryDepthSList
RtlTimeToTimeFields
RtlFreeAnsiString
PsGetVersion
ExDeleteNPagedLookasideList
IoAllocateMdl
ZwOpenKey
__C_specific_handler

fltmgr.sys

FltGetVolumeName
FltEnumerateVolumes
FltObjectDereference
FltQueryInformationFile

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKFsFt64.sys
.sys windows:6 windows x64 arch:x64

8800a239d236c089784b93c9e76eaeaf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:8d:2d:ac:a4:46:65:54:6b:b5:87:97:81:91:a8:bf
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

31-10-2007 00:00

Not After

30-10-2017 23:59

Subject

CN=GeoTrust Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

ad:3e:70:ab:26:8f:7d:34:8f:bf:3e:05:0f:cb:62:ee:76:6b:58:99:6a:f9:aa:cf:ed:2d:bc:59:c5:ac:ef:dd
Signer

Actual PE Digest

ad:3e:70:ab:26:8f:7d:34:8f:bf:3e:05:0f:cb:62:ee:76:6b:58:99:6a:f9:aa:cf:ed:2d:bc:59:c5:ac:ef:dd

Digest Algorithm

sha256

PE Digest Matches

true

80:73:86:a2:95:27:2f:be:7a:0b:4c:94:51:fd:4e:48:cd:00:b6:07
Signer

Actual PE Digest

80:73:86:a2:95:27:2f:be:7a:0b:4c:94:51:fd:4e:48:cd:00:b6:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\worksp~1\engdev~3.0\trunk\bin\free\amd64\TKFsFt64.pdb

Imports

ntoskrnl.exe

ObfReferenceObject
ObfDereferenceObject
KeReleaseSpinLock
IoDeleteSymbolicLink
KeBugCheckEx
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeAcquireSpinLockRaiseToDpc
RtlInitUnicodeString
ExAcquireResourceExclusiveLite
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
KeLeaveCriticalRegion
KeSetEvent
KeInitializeEvent
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExReleaseResourceLite
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltCancelFileOpen
FltStartFiltering

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKPcFtCb64.sys
.sys windows:6 windows x64 arch:x64

3e4f96ca1877df42bb00ad1fef3003f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\en4822~1\worksp~1\trunk\bin\free\amd64\TKPcFtCb64.pdb

Imports

ntoskrnl.exe

PsProcessType
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
KeInitializeEvent
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForSingleObject
PsGetVersion
PsThreadType
IoCreateSymbolicLink
MmIsAddressValid
IoCreateDevice
DbgPrint
KeReleaseSpinLock
ObfReferenceObject
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
IoThreadToProcess
IoGetCurrentProcess
KeStackAttachProcess
KeBugCheckEx
_stricmp
ExAcquireResourceExclusiveLite
ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
KeLeaveCriticalRegion
_wcsnicmp
KeSetEvent
ZwQuerySystemInformation
KeEnterCriticalRegion
ZwQueryValueKey
ExReleaseResourceLite
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
ExInitializeResourceLite
ZwOpenKey
RtlUnicodeToMultiByteN

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKPcFtHk64.sys
.sys windows:6 windows x64 arch:x64

52a03f6d8335de264bd39ec87945a503

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:11:91:7d:59:5c:99:ae:4f:18:c6:e1:06:24:07:28
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2010 00:00

Not After

07-12-2011 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:89:33:47:7f:88:36:12:81:45:3e:05:3b:e1:83:cd:43:47:37:26
Signer

Actual PE Digest

b9:89:33:47:7f:88:36:12:81:45:3e:05:3b:e1:83:cd:43:47:37:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\17440~1.wor\2ada3~1.sou\engdev~3\branches\if2e25~1.01_\bin\free\amd64\TKPcFtHk64.pdb

Imports

ntoskrnl.exe

ExAcquireResourceExclusiveLite
KeClearEvent
KeReadStateEvent
KeLeaveCriticalRegion
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
PsSetCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
IoCreateSymbolicLink
PsGetCurrentProcessId
ObfDereferenceObject
IoCreateDevice
ExInitializeResourceLite
KeReleaseSpinLock
ObfReferenceObject
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
_strnicmp
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlUnicodeStringToAnsiString
IofCompleteRequest
RtlFreeAnsiString
PsGetVersion
KeStackAttachProcess
RtlQueryRegistryValues

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKRgAc2k64.sys
.sys windows:6 windows x64 arch:x64

39f5b716dfa8b43761734ba4fb230c44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\enfcbb~1\worksp~1\trunk\bin\free\amd64\TKRgAc2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoIs32bitProcess
KeReleaseSpinLock
ZwUnloadDriver
ExEventObjectType
ObReferenceObjectByHandle
IoCreateSymbolicLink
RtlCopyUnicodeString
IoCreateDevice
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
IofCallDriver
ExFreePoolWithTag
ExInterlockedInsertTailList
wcschr
KeSetEvent
strchr
ZwCreateFile
ZwClose
PsGetCurrentThreadId
PsGetCurrentProcessId
ZwQueryInformationToken
ZwWriteFile
DbgPrint
KeBugCheckEx
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
MmUnmapLockedPages
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
KeClearEvent
KeReadStateEvent
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
PsReferenceImpersonationToken
PsReferencePrimaryToken
KeInitializeEvent
RtlInitAnsiString
MmBuildMdlForNonPagedPool
IoFreeMdl
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
ExSystemTimeToLocalTime
PsTerminateSystemThread
IoGetCurrentProcess
ExReleaseResourceLite
IofCompleteRequest
KeWaitForSingleObject
RtlTimeToTimeFields
PsGetVersion
ExDeleteResourceLite
ExInitializeResourceLite
ObOpenObjectByPointer
IoAllocateMdl

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKRgFtXp64.sys
.sys windows:6 windows x64 arch:x64

bd0a2c61a8c6a84206ead3cad2934d2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\jobs\en79e8~1\worksp~1\trunk\bin\free\amd64\TKRgFtXp64.pdb

Imports

ntoskrnl.exe

KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
KeInitializeEvent
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForSingleObject
PsGetVersion
IoCreateSymbolicLink
PsGetCurrentProcessId
MmIsAddressValid
IoCreateDevice
DbgPrint
KeReleaseMutex
KeReleaseSpinLock
ObfReferenceObject
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
ObQueryNameString
wcsstr
DbgBreakPoint
ObReferenceObjectByHandle
CmRegisterCallback
CmUnRegisterCallback
KeBugCheckEx
RtlUnicodeToMultiByteN
_stricmp
ExAcquireResourceExclusiveLite
_strnicmp
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
ExFreePoolWithTag
KeReadStateEvent
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
ExInitializeNPagedLookasideList
PsLookupProcessByProcessId
_wcsnicmp
KeSetEvent
ExpInterlockedPushEntrySList
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySystemInformation
ExpInterlockedPopEntrySList
KeUnstackDetachProcess
KeEnterCriticalRegion
RtlFreeUnicodeString
strncpy
ZwQueryValueKey
IoGetCurrentProcess
ExReleaseResourceLite
ZwClose
IofCompleteRequest
ExQueryDepthSList
RtlFreeAnsiString
ExInitializeResourceLite
KeStackAttachProcess
ZwOpenKey
__C_specific_handler

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKTool2k64.sys
.sys windows:6 windows x64 arch:x64

2ca3150ee7102c46d43e4d7e618f906b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36
Signer

Actual PE Digest

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\amd64\TKTool2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
IoRegisterShutdownNotification
RtlInitUnicodeString
IoDeleteDevice
ZwUnloadDriver
IoCreateSymbolicLink
RtlCopyUnicodeString
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwClose
ZwQueryInformationFile
ZwOpenKey
KeBugCheckEx
DbgPrint
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySymbolicLinkObject
ZwDeleteValueKey
ZwOpenSymbolicLinkObject
ZwQueryValueKey
IofCompleteRequest
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKFsAv.sys
.sys windows:6 windows x86 arch:x86

fc808ac055b42537a527601e69fc124a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\project\nos-d\engdev_0609_tkfsav\trunk\2.0\bin\free\i386\TKFsAv.pdb

Imports

ntoskrnl.exe

PsGetCurrentProcessId
PsGetCurrentThreadId
ExInitializeResourceLite
ObfDereferenceObject
ObReferenceObjectByHandle
PsThreadType
ExEventObjectType
KeInitializeSemaphore
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
_allmul
memcpy
KeResetEvent
KeSetEvent
ExfInterlockedRemoveHeadList
IoGetDeviceObjectPointer
KeStackAttachProcess
IofCallDriver
IoBuildDeviceIoControlRequest
ObOpenObjectByPointer
PsReferencePrimaryToken
IoGetCurrentProcess
ZwClose
ZwQueryInformationToken
wcsncmp
wcsncat
_wcsnicmp
KeInitializeEvent
ZwUnloadDriver
ExFreePoolWithTag
DbgPrint
KeReleaseSemaphore
KeWaitForSingleObject
KeGetCurrentThread
KeUnstackDetachProcess
KeReadStateEvent
_alldiv
ZwWriteFile
_vsnprintf
ZwCreateFile
towlower
wcsrchr
ExAcquireResourceSharedLite
PsProcessType
ZwQuerySystemInformation
IoThreadToProcess
ZwOpenProcess
ZwQueryObject
PsLookupProcessByProcessId
MmIsAddressValid
PsCreateSystemThread
PsTerminateSystemThread
ZwTerminateProcess
ObQueryNameString
IoFileObjectType
MmUnmapViewOfSection
KeTickCount
KeBugCheckEx
IoCreateDevice
IoCreateSymbolicLink
memset
ExDeleteResourceLite
RtlCopyUnicodeString
RtlInitUnicodeString
IoDeleteSymbolicLink
ExfInterlockedInsertTailList
IoDeleteDevice
RtlAnsiCharToUnicodeChar
ObOpenObjectByName
IoDriverObjectType
IofCompleteRequest
ExAllocatePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExDeleteNPagedLookasideList
PsGetVersion
_strnicmp
strncpy
ProbeForRead
MmGetSystemRoutineAddress
PsReferenceImpersonationToken
strncmp
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeClearEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapLockedPages
_stricmp
ZwQueryValueKey
ZwOpenKey
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

fltmgr.sys

FltEnumerateVolumes
FltGetVolumeName
FltObjectDereference
FltQueryInformationFile

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKFsFt.sys
.sys windows:6 windows x86 arch:x86

6a28edfa5c6de8f65372b27385104cc0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:52:8c:2a:93:f5:59:bf:6f:0e:84:ea:58:8c:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:e3:0d:17:f7:3c:99:a0:fb:f8:cd:15:fe:50:56:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27-06-2014 00:00

Not After

24-06-2015 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:8d:2d:ac:a4:46:65:54:6b:b5:87:97:81:91:a8:bf
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

31-10-2007 00:00

Not After

30-10-2017 23:59

Subject

CN=GeoTrust Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

74:8c:9e:85:d0:2d:4d:f6:66:67:1c:74:90:94:35:52:53:7f:56:35:a3:b2:c9:05:70:22:c2:30:30:97:c0:67
Signer

Actual PE Digest

74:8c:9e:85:d0:2d:4d:f6:66:67:1c:74:90:94:35:52:53:7f:56:35:a3:b2:c9:05:70:22:c2:30:30:97:c0:67

Digest Algorithm

sha256

PE Digest Matches

true

a2:8a:c6:77:66:6e:66:c9:60:77:79:f1:24:c1:d8:b0:d2:75:6a:7a
Signer

Actual PE Digest

a2:8a:c6:77:66:6e:66:c9:60:77:79:f1:24:c1:d8:b0:d2:75:6a:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\worksp~1\engdev~3.0\trunk\bin\free\i386\TKFsFt.pdb

Imports

ntoskrnl.exe

KeTickCount
IoDeleteSymbolicLink
ObfReferenceObject
ObfDereferenceObject
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
ZwClose
ObReferenceObjectByHandle
memset
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
KeSetEvent
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlUnwind
KeBugCheckEx

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

fltmgr.sys

FltRegisterFilter
FltStartFiltering
FltUnregisterFilter
FltCancelFileOpen

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 384B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKPcFtCb.sys
.sys windows:6 windows x86 arch:x86

08b130c4919fce3888098ed6eebdd31f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a6:90:9c:29:f5:2c:6a:c4:74:42:9e:3c:66:7d:50:1c:ce:a0:46:94
Signer

Actual PE Digest

a6:90:9c:29:f5:2c:6a:c4:74:42:9e:3c:66:7d:50:1c:ce:a0:46:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\hudson\worksp~1\enae3d~1.0\trunk\bin\free\i386\TKPcFtCb.pdb

Imports

ntoskrnl.exe

KeInitializeGuardedMutex
IoCreateSymbolicLink
IoCreateDevice
ObOpenObjectByPointer
KeServiceDescriptorTable
ObfDereferenceObject
ObfReferenceObject
KeStackAttachProcess
PsSetCreateProcessNotifyRoutineEx
PsThreadType
PsProcessType
IoGetCurrentProcess
IoThreadToProcess
ObReferenceObjectByHandle
KeTickCount
RtlInitUnicodeString
IoDeleteDevice
ZwClose
memset
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetVersion
KeSetEvent
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
ZwQuerySystemInformation
_stricmp
KeBugCheckEx
RtlUnwind
DbgPrint
RtlUnicodeToMultiByteN

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKPcFtHk.sys
.sys windows:6 windows x86 arch:x86

67ce3513ca9715ab9163d0e087a177aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\en4822~1\worksp~1\trunk\bin\free\i386\TKPcFtHk.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
ObOpenObjectByPointer
KeServiceDescriptorTable
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeWaitForSingleObject
KeInitializeEvent
DbgPrint
PsGetVersion
PsSetCreateProcessNotifyRoutine
PsThreadType
PsProcessType
ObfDereferenceObject
ObfReferenceObject
KeStackAttachProcess
IoGetCurrentProcess
IoThreadToProcess
ObReferenceObjectByHandle
KeTickCount
KeBugCheckEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoDeleteDevice
ZwClose
memset
IofCompleteRequest
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
memcpy
_wcsnicmp
KeSetEvent
KeReadStateEvent
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
ZwQuerySystemInformation
_stricmp
ZwQueryValueKey
ZwOpenKey
RtlUnwind
RtlUnicodeToMultiByteN

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKRgAc2k.sys
.sys windows:6 windows x86 arch:x86

18af0e4bd462a0c6150fb88eab1780f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\enfcbb~1\worksp~1\trunk\bin\free\i386\TKRgAc2k.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
ObReferenceObjectByHandle
ExEventObjectType
ObfDereferenceObject
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
memcpy
ExfInterlockedInsertTailList
IoDeleteSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
strchr
wcschr
KeSetEvent
ZwClose
ZwQueryInformationToken
DbgPrint
ZwWriteFile
ZwCreateFile
KeTickCount
KeBugCheckEx
IoDeleteDevice
RtlCopyUnicodeString
ExFreePoolWithTag
memset
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
PsGetVersion
IoGetCurrentProcess
_strnicmp
strncpy
ObOpenObjectByPointer
PsReferencePrimaryToken
PsReferenceImpersonationToken
KeGetCurrentThread
RtlFreeUnicodeString
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapLockedPages
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKRgFt2k.sys
.sys windows:6 windows x86 arch:x86

763aace061cbd9816365c596e1891de9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:26:5d:2c:f1:b8:c4:91:16:a4:7d:f6:c4:b0:72:86:4a:fd:5d:c4
Signer

Actual PE Digest

61:26:5d:2c:f1:b8:c4:91:16:a4:7d:f6:c4:b0:72:86:4a:fd:5d:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\worksp~1\engdev~4.0\trunk\bin\free\i386\TKRgFt2k.pdb

Imports

ntoskrnl.exe

memset
PsGetCurrentProcessId
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
DbgBreakPoint
MmIsAddressValid
ObQueryNameString
wcsstr
ObReferenceObjectByHandle
ExGetPreviousMode
ObfDereferenceObject
ObfReferenceObject
RtlInitUnicodeString
ZwCreateKey
ZwSetValueKey
ZwDeleteKey
ZwFlushKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwQueryKey
ZwOpenKey
ProbeForRead
MmUserProbeAddress
ProbeForWrite
KeTickCount
IoCreateDevice
IoCreateSymbolicLink
ZwDeleteValueKey
RtlUnwind
DbgPrint
RtlUnicodeToMultiByteN
ZwClose
IofCompleteRequest
KeInitializeEvent
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
memcpy
PsGetVersion
_wcsnicmp
IoGetCurrentProcess
_strnicmp
PsLookupProcessByProcessId
strncpy
KeUnstackDetachProcess
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
KeSetEvent
PsTerminateSystemThread
KeReadStateEvent
PsCreateSystemThread
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
MmBuildMdlForNonPagedPool
ZwQuerySystemInformation
_stricmp
MmMapLockedPages
MmCreateMdl
KeServiceDescriptorTable
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKRgFtXp.sys
.sys windows:6 windows x86 arch:x86

386d755c10fcc453c1d7110119ceeec7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\jobs\en79e8~1\worksp~1\trunk\bin\free\i386\TKRgFtXp.pdb

Imports

ntoskrnl.exe

memset
KeInitializeMutex
PsGetCurrentProcessId
DbgPrint
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForSingleObject
RtlInitUnicodeString
KeReleaseMutex
ObfDereferenceObject
ObfReferenceObject
CmRegisterCallback
CmUnRegisterCallback
ObQueryNameString
ObReferenceObjectByHandle
DbgBreakPoint
wcsstr
KeTickCount
IoCreateDevice
IoCreateSymbolicLink
KeInitializeEvent
RtlUnwind
RtlUnicodeToMultiByteN
ZwClose
IofCompleteRequest
_allmul
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
memcpy
_wcsnicmp
IoGetCurrentProcess
_strnicmp
PsLookupProcessByProcessId
strncpy
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
RtlFreeUnicodeString
KeSetEvent
KeReadStateEvent
ExInitializeResourceLite
KeClearEvent
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
_stricmp
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKTool2k.sys
.sys windows:6 windows x86 arch:x86

d9a12bd346b9522bd63c7d74b98a85b2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-11-2012 00:00

Not After

28-12-2013 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95
Signer

Actual PE Digest

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\i386\TKTool2k.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoRegisterShutdownNotification
IoRegisterPlugPlayNotification
memcpy
RtlCopyUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
memset
ZwClose
ZwSetInformationFile
ZwQueryInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwOpenKey
KeTickCount
DbgPrint
RtlAnsiCharToUnicodeChar
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
IoDeleteSymbolicLink
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryValueKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwDeleteValueKey
RtlUnwind
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKToolu.dll
.dll windows:4 windows x86 arch:x86

c19cf5ba61ddde0c28a963f5f3e3161d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:32:28:6b:23:97:7e:a3:43:10:4e:59:10:27:96:13:83:70:6c:aa:eb:ca:9b:ff:3a:65:bd:66:4a:4e:25:44
Signer

Actual PE Digest

3a:32:28:6b:23:97:7e:a3:43:10:4e:59:10:27:96:13:83:70:6c:aa:eb:ca:9b:ff:3a:65:bd:66:4a:4e:25:44

Digest Algorithm

sha256

PE Digest Matches

true

46:18:cb:68:f4:d3:81:e0:ef:39:d9:c5:4d:ef:7f:3c:c3:fd:fe:cd
Signer

Actual PE Digest

46:18:cb:68:f4:d3:81:e0:ef:39:d9:c5:4d:ef:7f:3c:c3:fd:fe:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\project\nos-d\ENGDEV_0607_TKTOOL\trunk\1.0\dll\TKTool\x86\ReleaseU\TKToolU.pdb

Imports

kernel32

SetLastError
GetTickCount
GetVolumeNameForVolumeMountPointW
FreeLibrary
GetCurrentProcess
GetSystemInfo
GetVersionExW
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
FlushFileBuffers
Sleep
IsBadWritePtr
IsBadReadPtr
WriteFile
GetFileAttributesW
GetVolumeInformationW
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
GetVersion
GetDriveTypeW
CloseHandle
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FormatMessageW
LocalFree
CreateFileW
GetSystemDirectoryW
GetLastError
DeviceIoControl
CreateFileA
OutputDebugStringW
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RtlUnwind
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
SetEnvironmentVariableA

user32

IsCharUpperW
wsprintfW
MessageBoxW
PostQuitMessage
IsCharAlphaW

advapi32

DeleteService
QueryServiceStatus
ControlService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
OpenSCManagerW

Exports

Exports

TKToolClose
TKToolDrvFClose
TKToolDrvFindClose
TKToolDrvFindFirstFile
TKToolDrvFindFirstFileEx
TKToolDrvFindNextFile
TKToolDrvFopen
TKToolDrvFopenEx
TKToolDrvFread
TKToolDrvFseek
TKToolDrvFwrite
TKToolDrvGetFileSize
TKToolDrvGetFileSizeEx
TKToolEnumHiddenProcesses
TKToolEnumKernelModeHiddenProcesses
TKToolEnumProcesses
TKToolEnumProcessesEx
TKToolEnumUserModeHiddenProcesses
TKToolFindClose
TKToolFindFirstFile
TKToolFindNextFile
TKToolGetDllVersion
TKToolGetDrvVersion
TKToolInit
TKToolInitCharacterSet
TKToolLoadAtStartUp
TKToolLoadDriver
TKToolLoadDriverEx
TKToolMoveFileAfterReboot
TKToolRcvDeleteFile
TKToolRcvGetModNameFromAddr
TKToolRcvRecoverSdt
TKToolRebootCure
TKToolRecoverKernelModeHiddenProcess
TKToolRemvStoreFinal
TKToolSetCurPathForImagePath
TKToolTerminateProcess
TKToolTerminateThread
TKToolUnloadDriver

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/BWT.dll
.dll windows:4 windows x86 arch:x86

b16b05115529f7bbc3cb142f11ec7320

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b1:1c:21:24:c1:96:72:1a:17:b7:c6:69:53:68:94:d7:3b:fc:3e:7e:89:34:8c:0b:a5:11:90:b2:60:9b:4f:67
Signer

Actual PE Digest

b1:1c:21:24:c1:96:72:1a:17:b7:c6:69:53:68:94:d7:3b:fc:3e:7e:89:34:8c:0b:a5:11:90:b2:60:9b:4f:67

Digest Algorithm

sha256

PE Digest Matches

true

2a:af:32:35:28:48:5b:ef:21:09:3e:21:b1:8e:97:42:a5:0a:0c:1d
Signer

Actual PE Digest

2a:af:32:35:28:48:5b:ef:21:09:3e:21:b1:8e:97:42:a5:0a:0c:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\bwt\BWT.pdb

Imports

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect

crypt32

CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertOpenSystemStoreW

rpcrt4

UuidCreate

kernel32

WriteConsoleA
GetConsoleOutputCP
SetStdHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
OutputDebugStringW
LeaveCriticalSection
GetLastError
CreateThread
WaitForSingleObject
CloseHandle
lstrlenA
MultiByteToWideChar
CreateEventW
GetProcAddress
GetModuleHandleW
Sleep
lstrlenW
WideCharToMultiByte
SetEvent
FindResourceW
WriteConsoleW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateFileW
CreateFileMappingW
MapViewOfFile
GetFileSize
UnmapViewOfFile
GetWindowsDirectoryW
GetExitCodeThread
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
GetConsoleMode
ReadFile
CreateFileA
FlushFileBuffers
OutputDebugStringA
InterlockedIncrement
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
VirtualFree
VirtualAlloc
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LoadLibraryA
SetFilePointer
GetConsoleCP

user32

UnregisterClassA

advapi32

RevertToSelf
ImpersonateLoggedOnUser
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

BWTControl

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/BwtTrust.dll
.dll windows:4 windows x86 arch:x86

03a1fe3fde0b98269544b8bec2d124a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5
Signer

Actual PE Digest

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5

Digest Algorithm

sha256

PE Digest Matches

true

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de
Signer

Actual PE Digest

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\Release\BwtTrust.pdb

Imports

psapi

GetMappedFileNameW

kernel32

CreateFileMappingW
GetCurrentProcess
QueryDosDeviceW
GetLogicalDriveStringsW
SetEndOfFile
SetFilePointer
GetFileSize
WriteFile
GetDriveTypeW
GetLastError
MapViewOfFile
OutputDebugStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
SetEvent
FindClose
UnmapViewOfFile
SetFileAttributesW
DeleteFileW
GetFileAttributesW
CloseHandle
CreateFileW
CompareStringW
OpenFileMappingW
TlsSetValue
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
SetEnvironmentVariableA
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
VirtualAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
FlushFileBuffers
CompareStringA

advapi32

RegQueryValueExW
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
RegOpenKeyExW

Exports

Exports

RequestService

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/NpBWT.dll
.dll windows:5 windows x86 arch:x86

a60200e3067da2c9a407d52e73c19fac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44
Signer

Actual PE Digest

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44

Digest Algorithm

sha256

PE Digest Matches

true

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a
Signer

Actual PE Digest

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpBWTStatic\Win32\NpBWT.pdb

Imports

kernel32

GetSystemInfo
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
MapViewOfFile
UnmapViewOfFile
GetLastError
CreateFileMappingW
OpenFileMappingW
CloseHandle
VirtualFree
VirtualAlloc
FreeLibrary
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
SetLastError
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW

Exports

Exports

fnBWTControl

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/NpHttpsLib.dll
.dll windows:5 windows x86 arch:x86

a7df12cc332635377ea71a48f8b49a32

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:a6:12:0a:03:11:aa:86:29:0f:db:06:35:97:8d:21:ce:c3:b2:ad:3f:f5:83:58:1c:bc:80:4c:ca:9f:b6:32
Signer

Actual PE Digest

4a:a6:12:0a:03:11:aa:86:29:0f:db:06:35:97:8d:21:ce:c3:b2:ad:3f:f5:83:58:1c:bc:80:4c:ca:9f:b6:32

Digest Algorithm

sha256

PE Digest Matches

true

73:c7:b4:57:4d:7a:c4:3d:19:9b:3a:19:7e:0f:4f:3b:a3:f6:1c:73
Signer

Actual PE Digest

73:c7:b4:57:4d:7a:c4:3d:19:9b:3a:19:7e:0f:4f:3b:a3:f6:1c:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpHttpsLibStatic\Win32\NpHttpsLib.pdb

Imports

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW

ws2_32

gethostname
ioctlsocket
__WSAFDIsSet
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
shutdown
WSASetLastError
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
send
recv
WSAGetLastError
WSAStartup
WSACleanup
select

wldap32

ord26
ord30
ord32
ord35
ord79
ord50
ord33
ord301
ord27
ord41
ord46
ord60
ord143
ord211
ord22
ord200

kernel32

FileTimeToLocalFileTime
GetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeA
FindFirstFileExA
CreateFileA
ReadConsoleInputA
SetConsoleMode
FileTimeToSystemTime
GetProcessHeap
GetFileInformationByHandle
FlushConsoleInputBuffer
GetVersionExW
GlobalMemoryStatus
GetVersion
ExpandEnvironmentStringsA
LoadLibraryA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
SleepEx
SetEnvironmentVariableA
CompareStringW
FlushFileBuffers
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetLastError
CloseHandle
VirtualFree
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
SetEvent
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
CreateEventW
DeleteCriticalSection
GetSystemTime
CreateDirectoryW
FindClose
DeleteFileW
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
SetLastError
LCMapStringW
GetStringTypeW
GetTimeZoneInformation
RaiseException
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
RtlUnwind
GetConsoleCP
GetConsoleMode
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
GetDriveTypeW

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
fnCloseFtp
fnCloseHttps
fnCreateDirectoryFtp
fnDeleteDirectoryFtp
fnDeleteFileFtp
fnGetBuffer
fnGetBufferData
fnGetBufferDataSize
fnGetCurlCode
fnGetFileFtp
fnGetFileListFtp
fnOpenFtp
fnOpenHttps
fnPerform
fnPutFileFtp
fnPutFileRenameFtp
fnSetConnectionClose
fnSetHttpDownloadFile
fnSetHttpHeader
fnSetHttpTypeGet
fnSetHttpTypePost
fnSetProxy
fnSetSFTPKeyFile
fnSetSSLVerifyPear
fnSetTimeoutMilliSec
fnSetUserAgent
libssh2_banner_set
libssh2_base64_decode
libssh2_channel_close
libssh2_channel_direct_tcpip_ex
libssh2_channel_eof
libssh2_channel_flush_ex
libssh2_channel_forward_accept
libssh2_channel_forward_cancel
libssh2_channel_forward_listen_ex
libssh2_channel_free
libssh2_channel_get_exit_signal
libssh2_channel_get_exit_status
libssh2_channel_handle_extended_data
libssh2_channel_handle_extended_data2
libssh2_channel_open_ex
libssh2_channel_process_startup
libssh2_channel_read_ex
libssh2_channel_receive_window_adjust
libssh2_channel_receive_window_adjust2
libssh2_channel_request_pty_ex
libssh2_channel_request_pty_size_ex
libssh2_channel_send_eof
libssh2_channel_set_blocking
libssh2_channel_setenv_ex
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_window_read_ex
libssh2_channel_window_write_ex
libssh2_channel_write_ex
libssh2_channel_x11_req_ex
libssh2_exit
libssh2_free
libssh2_hostkey_hash
libssh2_init
libssh2_keepalive_config
libssh2_keepalive_send
libssh2_knownhost_add
libssh2_knownhost_addc
libssh2_knownhost_check
libssh2_knownhost_checkp
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_readline
libssh2_knownhost_writefile
libssh2_knownhost_writeline
libssh2_poll
libssh2_poll_channel_read
libssh2_scp_recv
libssh2_scp_send64
libssh2_scp_send_ex
libssh2_session_abstract
libssh2_session_banner_get
libssh2_session_banner_set
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_get_blocking
libssh2_session_get_timeout
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_methods
libssh2_session_set_blocking
libssh2_session_set_timeout
libssh2_session_startup
libssh2_session_supported_algs
libssh2_sftp_close_handle
libssh2_sftp_fstat_ex
libssh2_sftp_fstatvfs
libssh2_sftp_get_channel
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_tell
libssh2_sftp_tell64
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_trace
libssh2_trace_sethandler
libssh2_userauth_authenticated
libssh2_userauth_hostbased_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey
libssh2_userauth_publickey_fromfile_ex
ssl2_ciphers
ssl3_ciphers

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/TYAVPU_000.bin
coredll/rtd/TYAVP_001.bin
coredll/rtd/TYAVSU_000.bin
coredll/rtd/TeCtrl.dll
.dll windows:4 windows x86 arch:x86

f2f04e8d6a48038cbe0d8f6678090077

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c5:a2:4b:91:a7:11:0b:3b:24:00:de:50:f8:15:82:d7:eb:ae:68:9d:2d:30:64:e2:d2:3f:4f:12:81:ac:31:fe
Signer

Actual PE Digest

c5:a2:4b:91:a7:11:0b:3b:24:00:de:50:f8:15:82:d7:eb:ae:68:9d:2d:30:64:e2:d2:3f:4f:12:81:ac:31:fe

Digest Algorithm

sha256

PE Digest Matches

true

05:03:fb:75:b2:ff:56:bc:87:b9:e3:9c:43:1d:2b:a1:49:24:02:8c
Signer

Actual PE Digest

05:03:fb:75:b2:ff:56:bc:87:b9:e3:9c:43:1d:2b:a1:49:24:02:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrl.pdb

Imports

kernel32

WaitForSingleObject
CreateRemoteThread
GetModuleHandleA
OpenProcess
UnmapViewOfFile
QueryDosDeviceA
GetLogicalDriveStringsA
MapViewOfFile
CreateFileMappingA
TerminateThread
CreateThread
DuplicateHandle
LocalFree
LocalAlloc
HeapFree
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
SetEvent
InterlockedExchange
GetVersion
CreateMutexA
OpenMutexA
GlobalMemoryStatus
RemoveDirectoryA
FindClose
FindNextFileA
SetFileAttributesA
FindFirstFileA
CreateDirectoryA
GetTempPathA
Sleep
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
GetTickCount
lstrlenW
CompareStringA
GetCurrentProcess
lstrcmpiA
lstrcmpiW
lstrlenA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
OutputDebugStringA
OutputDebugStringW
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
ResetEvent
ExpandEnvironmentStringsA
GetWindowsDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetThreadLocale
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetVersionExA
GetFileAttributesA
DeleteFileA
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetLastError
GlobalAlloc
SetLastError
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GlobalFree
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
CreateFileA
GetFileSize
ReadFile
CompareStringW
RaiseException
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
ExitProcess
WriteFile
GetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA

user32

CharLowerA
CharUpperW
UnregisterClassA
CharUpperA
CharLowerW
wsprintfA

advapi32

RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
AdjustTokenPrivileges

shell32

SHGetFolderPathA

shlwapi

PathFindExtensionA
PathIsRelativeA

imagehlp

MapAndLoad
UnMapAndLoad

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertGetNameStringA

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeEnableBWT
NpeEnableBWTEx
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 340KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/TeCtrlu.dll
.dll windows:4 windows x86 arch:x86

5fc585f53e552845cbfa41093fe3bbe6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19-07-2017 00:00

Not After

18-07-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

36:83:48:55:b0:1a:b5:ca:75:00:11:94:88:d1:14:0d:28:17:0d:3f:44:62:2b:45:0a:35:9c:f4:fc:ec:88:e7
Signer

Actual PE Digest

36:83:48:55:b0:1a:b5:ca:75:00:11:94:88:d1:14:0d:28:17:0d:3f:44:62:2b:45:0a:35:9c:f4:fc:ec:88:e7

Digest Algorithm

sha256

PE Digest Matches

true

f3:90:58:10:b9:47:13:51:3b:1a:30:db:71:35:f8:e0:49:1f:cc:a9
Signer

Actual PE Digest

f3:90:58:10:b9:47:13:51:3b:1a:30:db:71:35:f8:e0:49:1f:cc:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrlu.pdb

Imports

kernel32

GetCurrentProcess
UnmapViewOfFile
QueryDosDeviceW
GetLogicalDriveStringsW
MapViewOfFile
CreateFileMappingW
WaitForSingleObject
CreateRemoteThread
GetModuleHandleW
OpenProcess
TerminateThread
CreateThread
DuplicateHandle
lstrcpynW
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameW
CreateMutexW
OpenMutexW
DeleteCriticalSection
InitializeCriticalSection
GlobalMemoryStatus
CreateDirectoryW
RemoveDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetTempPathW
GetVersionExW
GetTickCount
Sleep
lstrlenW
OutputDebugStringW
ResetEvent
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
FindResourceExW
SizeofResource
LockResource
LoadResource
FindResourceW
ExitProcess
GetModuleFileNameA
lstrlenA
GetThreadLocale
SetEnvironmentVariableA
CompareStringW
CompareStringA
MultiByteToWideChar
GetFileAttributesW
DeleteFileW
GlobalAlloc
SetLastError
GlobalFree
CreateFileA
GetLastError
LoadLibraryW
CloseHandle
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InterlockedExchange
GetSystemDirectoryW
GetProcAddress
FreeLibrary
CreateFileW
GetFileSize
ReadFile
WideCharToMultiByte
CreateEventW
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
WriteFile
GetStdHandle
LCMapStringA
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler

user32

GetActiveWindow
UnregisterClassA
MessageBoxA
wsprintfW

advapi32

LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges

shell32

SHGetFolderPathW

shlwapi

PathIsRelativeW
PathFindExtensionW

imagehlp

MapAndLoad
UnMapAndLoad

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertGetNameStringW

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeEnableBWT
NpeEnableBWTEx
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 392KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/TySUtilu.dll
.dll windows:4 windows x86 arch:x86

a008632a5ab1b5de784efb061bb8f8e9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14
Signer

Actual PE Digest

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\TyScan\Sym\Release\TySUtilu.pdb

Imports

kernel32

CreateFileMappingW
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
MapViewOfFile
GetFileSize
WriteFile
SetLastError
SetFilePointer
ReadFile
GetLocalTime
UnmapViewOfFile
CloseHandle
GetFileAttributesW
CreateDirectoryW
GetLastError
DeleteFileW
OutputDebugStringW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

Exports

Exports

TBP_Close_File
TBP_Delete_From_Repository
TBP_Get_Object_Count
TBP_Get_Size_Of_Repository
TBP_Insert_Object_File
TBP_Insert_Object_Reg_Key
TBP_Insert_Object_Reg_Value
TBP_Is_Repository_Capable
TBP_Make_Category
TBP_Open_File
TBP_Read_Category
TBP_Read_Object
TBP_Restore_All_Object
TBP_Restore_Object
TBP_Restore_ObjectEx
TBP_Traverse_Repository

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/teexcept.dat
coredll/rtd/tyav32u.dll
.dll windows:4 windows x86 arch:x86

021e6f8bb522faeb0c3bb252a119d5e3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:90:be:b5:b4:e0:62:ae:a0:78:c3:df:0c:0b:87:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:81:66:84:77:e9:32:6c:96:de:0e:fb:27:c7:61:33
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-06-2016 00:00

Not After

21-07-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9f:d2:8e:6f:09:25:85:0b:48:fe:fd:45:c6:31:13:9c:cf:76:cc:b3:5c:0b:48:3e:2c:38:29:cf:34:25:60:f2
Signer

Actual PE Digest

9f:d2:8e:6f:09:25:85:0b:48:fe:fd:45:c6:31:13:9c:cf:76:cc:b3:5c:0b:48:3e:2c:38:29:cf:34:25:60:f2

Digest Algorithm

sha256

PE Digest Matches

true

ca:b9:b3:c2:9c:1e:05:94:52:83:83:1d:d6:bc:ea:5d:02:1d:07:f5
Signer

Actual PE Digest

ca:b9:b3:c2:9c:1e:05:94:52:83:83:1d:d6:bc:ea:5d:02:1d:07:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenFileMappingW
GetFileAttributesW
GetCurrentThread
Module32NextW
Module32FirstW
Sleep
TerminateProcess
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
WaitForSingleObject
GetWindowsDirectoryW
MultiByteToWideChar
FindNextFileW
MoveFileW
GetLogicalDriveStringsW
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
SuspendThread
OpenThread
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
VirtualProtectEx
GetCurrentProcess
VirtualQuery
OpenEventW
LoadLibraryA
GetSystemDirectoryA
GetFileSize
OutputDebugStringW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetTempPathW
WriteConsoleW
GetStdHandle
OutputDebugStringA
FormatMessageW
GetSystemInfo
CreateFileA
SetFileTime
GetFileTime
FindFirstFileA
WritePrivateProfileStringW
MoveFileExW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
CreateEventW
QueryDosDeviceW
TerminateThread
CreateThread
DuplicateHandle
CreateRemoteThread
LocalFree
GetLogicalDrives
GetSystemDirectoryW
SetLastError
SetEvent
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetLongPathNameW
LeaveCriticalSection
EnterCriticalSection
OpenMutexW
CreateMutexW
GetTempFileNameW
SetEndOfFile
DeviceIoControl
GetShortPathNameW
FindFirstFileW
FindClose
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
Process32FirstW
Process32NextW
OpenProcess
ExpandEnvironmentStringsW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTickCount
CopyFileW
GetLastError
WideCharToMultiByte
WriteFile
SetFilePointer
ReadFile
GetVersionExW
GetDriveTypeW
CreateFileW
CloseHandle
GetLocalTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
RaiseException
SetConsoleCtrlHandler
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GlobalFree
GlobalAlloc
VirtualAlloc
VirtualProtect
VirtualFree
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
RtlUnwind
ExitProcess
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
TlsAlloc
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
SetStdHandle
DeleteFileA

advapi32

RegQueryValueExW
IsTextUnicode
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetUserNameW
LookupAccountNameW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
OpenThreadToken
ImpersonateSelf
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyW
OpenProcessToken
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW

ws2_32

WSCDeinstallProvider
WSCEnumProtocols
WSCInstallProvider
WSCGetProviderPath
WSACleanup

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

sfc

ord5

shlwapi

PathRemoveFileSpecW

imagehlp

MapFileAndCheckSumW

userenv

ExpandEnvironmentStringsForUserW

Exports

Exports

RecoverInlineHooking
TYAVSmartCure
TYAVSmartScan
TYAutoScanMemory
TYCheckBootVirus
TYCheckExceptList
TYCheckFile
TYCheckFileEx
TYCheckFileExW
TYCoreCheckBootVirus
TYCoreCheckFileCBCureEx
TYCoreCheckFileEx
TYCoreCheckFileExW
TYCoreGetEngineDateW
TYCoreInitEngine
TYCoreRecoveryBootVirus
TYCoreRecoveryFile
TYCoreRecoveryFileW
TYCoreSetOption
TYCoreSetReportCallBack
TYCoreUnInitEngine
TYCreateCache
TYCureMemory
TYCureProcess
TYDelInstance
TYDisablePattern
TYEnableNetworkScan
TYFlushBWTCache
TYGetBWTVer
TYGetBWTVerEx
TYGetBootInfo
TYGetEngineDate
TYGetEngineDateW
TYGetFileCRC
TYGetFileCRCEX
TYGetFileCRCEX2
TYGetFilePosCRC
TYGetPatternNum
TYInitEngine
TYListFile
TYListFileCRC
TYNewInstance
TYRecoveryBootVirus
TYRecoveryFile
TYRecoveryFileW
TYScanMemory
TYScanProcess
TYSetLiveUpdate
TYSetLoadLibDir
TYSetOption
TYSetServerSideScriptScan
TYSetYaraEnable
TYStopNetworkScan
TYUnInitEngine

Sections

.text
Size: 620KB - Virtual size: 619KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/tyavcuremap.dat
coredll/rtd/tyavexcept.bin
.dll windows:4 windows x86 arch:x86

5c54715227e960c5019e7a45d4b9d02a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/tyavexcept.dat
nosApsData.npb
nos_launcher.exe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:9e:d0:c4:a9:88:85:62:7e:f8:08:ff:8c:34:14:22:b6:5b:2b:7f:dd:60:cf:a5:25:ff:aa:d7:6c:ea:82:cb
Signer

Actual PE Digest

1c:9e:d0:c4:a9:88:85:62:7e:f8:08:ff:8c:34:14:22:b6:5b:2b:7f:dd:60:cf:a5:25:ff:aa:d7:6c:ea:82:cb

Digest Algorithm

sha256

PE Digest Matches

true

8a:6b:38:e1:eb:99:ce:89:fe:21:b0:67:b8:70:df:fd:83:ec:dc:23
Signer

Actual PE Digest

8a:6b:38:e1:eb:99:ce:89:fe:21:b0:67:b8:70:df:fd:83:ec:dc:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wdnyxedj
Size: 924KB - Virtual size: 924KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

qsgkyqdu
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nos_param.dat
nosapp.dll
.dll windows:4 windows x86 arch:x86

6dff77951608ec4f864ddb6ef6ab8739

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f0:02:18:4a:79:fc:4e:57:6d:6c:d0:5c:34:95:e9:19:a2:75:80:40:fb:10:d0:84:b1:6b:43:b6:21:af:79:cb
Signer

Actual PE Digest

f0:02:18:4a:79:fc:4e:57:6d:6c:d0:5c:34:95:e9:19:a2:75:80:40:fb:10:d0:84:b1:6b:43:b6:21:af:79:cb

Digest Algorithm

sha256

PE Digest Matches

true

7b:98:e1:9a:12:a6:32:c3:57:a7:48:46:b6:93:21:66:76:bc:40:44
Signer

Actual PE Digest

7b:98:e1:9a:12:a6:32:c3:57:a7:48:46:b6:93:21:66:76:bc:40:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\nossdk\nosapp\build\bin\release\nosapp.pdb

Imports

kernel32

IsBadReadPtr
GetLastError
GetProcessHeap
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleW
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
LocalAlloc
CreateDirectoryW
GetModuleHandleA
TerminateProcess
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentProcess
ReadFile
CreateProcessW
SetLastError
GetUserDefaultUILanguage
EnumUILanguagesW
FindClose
FindFirstFileW
CreateFileW
WriteFile
SetFileAttributesW
DeleteFileW
WideCharToMultiByte
OutputDebugStringW
FormatMessageW
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
GetSystemInfo
CreateEventA
GetSystemTimeAsFileTime
ResetEvent
CreateMutexW
OpenMutexW
ReleaseMutex
GetFileSize
SetFilePointer
MoveFileW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
GetFileAttributesW
HeapReAlloc
RaiseException
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
GetConsoleCP
GetConsoleMode
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateMutexA
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GetSystemTime
GlobalMemoryStatusEx
QueryPerformanceFrequency
WaitForSingleObject
SetEvent
CreateEventW
DeviceIoControl
Sleep
CreateFileA
GetTickCount
CloseHandle
TerminateThread
FreeLibrary
GetProcAddress
MultiByteToWideChar
LoadLibraryW

user32

FindWindowW
GetCursorPos
IsWindow
PostMessageW
MessageBoxW
GetSystemMetrics

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteExW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

iphlpapi

GetBestRoute
GetAdaptersInfo
GetAdaptersAddresses

ws2_32

inet_addr
inet_ntoa

netapi32

NetGetJoinInformation
NetApiBufferFree
NetLocalGroupGetMembers

userenv

DestroyEnvironmentBlock

crypt32

CryptMsgClose
CertGetNameStringW
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust

wininet

HttpOpenRequestW
HttpQueryInfoW
FtpOpenFileW
HttpSendRequestW
InternetReadFile
InternetQueryDataAvailable
InternetConnectW
InternetCloseHandle
FtpGetFileSize
InternetSetOptionW
InternetOpenW

advapi32

DuplicateTokenEx
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceConfigW
QueryServiceStatus
StartServiceW
GetTokenInformation
RegOpenKeyExW
SetTokenInformation
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
GetKernelObjectSecurity
GetSecurityDescriptorDacl
GetUserNameW
ConvertSidToStringSidW
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
CreateProcessAsUserW
SetKernelObjectSecurity
GetSidSubAuthorityCount
BuildExplicitAccessWithNameW
SetEntriesInAclW
MakeAbsoluteSD
GetSidSubAuthority
SetSecurityDescriptorDacl

ole32

CoTaskMemFree
CoCreateGuid

Exports

Exports

?getNpkWindowEditText@@YAKPAUHWND__@@PA_WH1H@Z
?getNpkWindowText@@YAKPAUHWND__@@PA_WH@Z
finalizeSdk
finalizeSdkEx
getDataFdsA
getDataFdsExA
getDataFdsExW
getDataFdsItemA
getDataFdsItemW
getDataFdsNoCodeA
getDataFdsNoCodeW
getDataFdsW
getFdsStatus
getMacAddressA
getMacAddressW
getNosStatus
getNpkSecOption
getNpkStatus
getNpkWindowEditTextA
getNpkWindowEditTextW
getNpkWindowTextA
getNpkWindowTextW
getNpnStatus
getProcProtectStatus
initializeSdkA
initializeSdkASyncExA
initializeSdkASyncExW
initializeSdkExA
initializeSdkExW
initializeSdkW
isVerified
pauseProcProtect
refreshFds
regNosSDKStatusCallback
registerNpkWindowsCallbackMsg
registerNpkWindowsMsg
registerNpkWindowsMsgParent
resumeProcProtect
setAllowPathA
setAllowPathW
setCustomDataFdsA
setCustomDataFdsW
setFdsTimeoutOption
setNosInstallOption
setNosInstallOptionExA
setNosInstallOptionExW
setNosLauncherA
setNosLauncherW
setNpkSecOption
setProtectPathA
setProtectPathW
setupNos
startFds
startFdsEx
startNos
startNpk
startNpkEx
startNpkSecurity
startNpn
startNpnEx
startProcProtect
startProcProtectEx
startSecure
startSecureEx
stopFds
stopNpk
stopNpkSecurity
stopNpn
stopProcProtect
stopSecure
unregisterNpkWindowsMsg
unregisterNpkWindowsMsgParent

Sections

.text
Size: 344KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nosscanner.npe
.exe windows:4 windows x86 arch:x86

cb1a2b590f3883cce13dded5f8181c21

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f4:67:53:7c:34:f7:f9:31:b5:b2:52:47:34:e4:cf:58:38:af:db:6a:fd:55:5f:13:66:b5:08:ee:65:32:ac:58
Signer

Actual PE Digest

f4:67:53:7c:34:f7:f9:31:b5:b2:52:47:34:e4:cf:58:38:af:db:6a:fd:55:5f:13:66:b5:08:ee:65:32:ac:58

Digest Algorithm

sha256

PE Digest Matches

true

f9:44:6d:9d:c9:85:d1:5c:f8:53:34:86:10:fe:56:01:e3:92:c5:89
Signer

Actual PE Digest

f9:44:6d:9d:c9:85:d1:5c:f8:53:34:86:10:fe:56:01:e3:92:c5:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\001_build\nProtectZ\product\npn60\nosscanner\build\bin\release\nosscanner.pdb

Imports

shlwapi

StrRetToStrW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

psapi

GetModuleBaseNameW

kernel32

ExitProcess
ExitThread
CreateThread
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
RtlUnwind
SetStdHandle
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
CreateFileA
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
CreateMutexA
RaiseException
VirtualAlloc
VirtualProtect
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
CreateMutexW
GetLastError
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
SetErrorMode
GetFileTime
FileTimeToLocalFileTime
GetTickCount
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
FlushFileBuffers
SystemTimeToFileTime
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
lstrlenA
InterlockedDecrement
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
GlobalAddAtomW
ResumeThread
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
LoadLibraryExW
CompareStringA
lstrcmpW
WritePrivateProfileStringW
FreeResource
MulDiv
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
InterlockedExchange
lstrlenW
lstrcpynW
GetWindowsDirectoryW
FindNextFileW
EnumUILanguagesW
GetLocaleInfoW
TerminateProcess
GetCurrentProcessId
ProcessIdToSessionId
CreateProcessW
GetTimeFormatW
GetDateFormatW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalAlloc
OpenMutexW
VerifyVersionInfoW
VerSetConditionMask
GetVersion
GetSystemInfo
GetModuleHandleW
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameW
ResetEvent
SetEvent
CreateEventW
ReleaseMutex
WaitForSingleObject
CreateEventA
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
GetUserDefaultUILanguage
OutputDebugStringW
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
CreateDirectoryW
LocalFree
GetLocalTime
Sleep
GetSystemDirectoryW
FormatMessageW
UnlockFile
LockFile
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
WideCharToMultiByte
MultiByteToWideChar
MoveFileW
DeleteFileW
SetFilePointer
WriteFile
ReadFile
GetFileSize
CreateFileW
SetLastError
GetDriveTypeW
FindResourceW
LoadResource
LockResource
SizeofResource
LCMapStringW

user32

PostThreadMessageW
RegisterClipboardFormatW
UnregisterClassW
CharUpperW
GetSysColorBrush
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
CharNextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
UnregisterClassA
LoadIconW
ClientToScreen
GetClientRect
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyState
PeekMessageW
ValidateRect
GetLastActivePopup
GetMenuItemID
GetMenuItemCount
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
IsWindowEnabled
EndDialog
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
EndPaint
BeginPaint
GetWindowDC
GrayStringW
SetRect
PtInRect
EnableWindow
SendMessageW
PostMessageW
GetDesktopWindow
LoadBitmapW
GetWindowRect
InvalidateRect
GetParent
IsWindow
ShowWindow
MessageBoxW
GetSystemMetrics
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextLengthW
GetWindow
GetWindowLongW
GetDC
ReleaseDC
GetCursorPos
ScreenToClient
TrackMouseEvent
DestroyWindow
SetFocus
SetWindowPos
OffsetRect
SystemParametersInfoW
MoveWindow
SetWindowTextW
InflateRect
CopyRect
WindowFromPoint
DrawTextExW
DestroyMenu
TabbedTextOutW
GetSubMenu
GetActiveWindow
GetNextDlgTabItem
SetCursor
GetSysColor
DestroyCursor
CopyIcon
LoadCursorW
SetWindowLongW
FillRect
DrawTextW
RedrawWindow

gdi32

GetTextColor
GetBkColor
CreateRectRgnIndirect
GetDeviceCaps
ExtSelectClipRgn
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
CreateSolidBrush
ScaleWindowExtEx
SetWindowExtEx
GetObjectW
BitBlt
Rectangle
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
StretchBlt
CreateFontIndirectW
GetTextExtentPoint32W
SetPixel
RoundRect
GetPixel
EndPath
SetTextColor
GetCurrentObject
CreatePen
BeginPath
SetTextJustification
TextOutW
GetTextMetricsW
SetBkMode
SetBkColor
MoveToEx
DeleteDC
LineTo
SelectObject
GetMapMode
PtVisible
GetWindowExtEx
RectVisible
GetViewportExtEx
ExtTextOutW
CreateBitmap
Escape
GetRgnBox
SaveDC
RestoreDC
ScaleViewportExtEx
SetMapMode
GetClipBox
SetViewportExtEx

msimg32

GradientFill
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

SetEntriesInAclW
RegDeleteKeyW
GetLengthSid
RegEnumKeyW
RegCreateKeyExW
RegQueryValueW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
SetKernelObjectSecurity
MakeAbsoluteSD
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSidSubAuthorityCount
GetKernelObjectSecurity
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSidToSidW
CreateProcessAsUserW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
DuplicateTokenEx
RegOpenKeyW
RegSetValueExW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetSidSubAuthority
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameW
ConvertSidToStringSidW

shell32

SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetDesktopFolder
SHGetMalloc

comctl32

_TrackMouseEvent
InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysAllocString
VariantCopy
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
SafeArrayDestroy

gdiplus

GdipSetPenDashStyle
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipDeleteBrush
GdipDeleteStringFormat
GdipAlloc
GdipDeleteFont
GdipCloneBrush
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipDrawImageRectI
GdipGetImageHeight
GdipCloneBitmapAreaI
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipDeletePen
GdipCreateHBITMAPFromBitmap
GdipDrawLineI
GdipCreatePen1
GdipSetLineColors
GdipFillRectangleI
GdipFillPolygonI
GdipDrawRectangleI
GdipCreateLineBrushFromRectI
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipCreateImageAttributes
GdipGetDC
GdipDisposeImageAttributes
GdipSetSmoothingMode
GdipAddPathLine
ord1
GdipClosePathFigure
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetPenColor
GdipReleaseDC

mpr

WNetGetConnectionW

wintrust

WinVerifyTrust

netapi32

NetGetJoinInformation
NetLocalGroupGetMembers
NetApiBufferFree

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptMsgGetParam
CryptQueryObject

Sections

.text
Size: 664KB - Virtual size: 663KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nossdk.npd
.dll windows:4 windows x86 arch:x86

1e144e3ac8b4894bab59569fcbe750e4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f1:d3:24:9b:1f:2b:c2:d5:32:1f:0a:b3:d8:ef:9b:8d:36:cd:a9:47:63:0e:7b:9a:e9:ea:8f:d9:e9:2e:96:f4
Signer

Actual PE Digest

f1:d3:24:9b:1f:2b:c2:d5:32:1f:0a:b3:d8:ef:9b:8d:36:cd:a9:47:63:0e:7b:9a:e9:ea:8f:d9:e9:2e:96:f4

Digest Algorithm

sha256

PE Digest Matches

true

68:92:f5:6a:e7:d8:43:b7:4d:92:77:70:d6:18:c5:29:19:a5:fe:4a
Signer

Actual PE Digest

68:92:f5:6a:e7:d8:43:b7:4d:92:77:70:d6:18:c5:29:19:a5:fe:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\nossdk\nossdk\build\bin\release\nossdk.pdb

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
GetOverlappedResult
WaitNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
GetSystemInfo
FlushFileBuffers
CreateFileW
CreateNamedPipeW
SetLastError
LocalFree
GetCurrentProcessId
SetEvent
CreateEventW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
DeviceIoControl
GetModuleHandleA
WriteFile
TerminateThread
ResetEvent
GetExitCodeThread
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
FindFirstFileW
FindClose
MoveFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
SetFilePointer
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
ReleaseMutex
OutputDebugStringW
GetUserDefaultUILanguage
GetLocalTime
CreateMutexW
OpenMutexW
FreeLibrary
CreateEventA
LocalAlloc
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
TerminateProcess
GetLocaleInfoW
EnumUILanguagesW
GetUserDefaultLCID
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
GetLocaleInfoA
LoadLibraryA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CreateMutexA
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetSystemTime
GetProcAddress
LoadLibraryW
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
Sleep
GetSystemTimeAsFileTime
GetLastError

user32

GetSystemMetrics
CharUpperW
MessageBoxW
GetCursorPos

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthority
SetSecurityInfo
OpenSCManagerW
GetUserNameW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSidSubAuthorityCount
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
CloseServiceHandle
QueryServiceConfigW
QueryServiceStatus
StartServiceW

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoCreateGuid
CoTaskMemFree

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathIsDirectoryW

psapi

GetModuleBaseNameW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wintrust

WinVerifyTrust

netapi32

NetGetJoinInformation
NetApiBufferFree
NetLocalGroupGetMembers

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertGetNameStringW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 440KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nosstarter.npe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

eb:c5:0a:ad:51:a8:b2:9a:ee:fc:9b:85:0f:17:79:aa:6b:be:4e:ac:59:40:95:90:83:6e:cb:3e:29:6c:39:ee
Signer

Actual PE Digest

eb:c5:0a:ad:51:a8:b2:9a:ee:fc:9b:85:0f:17:79:aa:6b:be:4e:ac:59:40:95:90:83:6e:cb:3e:29:6c:39:ee

Digest Algorithm

sha256

PE Digest Matches

true

2d:58:77:b8:ba:ca:a1:15:c1:9b:77:25:9a:a0:fc:4f:9e:e2:a0:6e
Signer

Actual PE Digest

2d:58:77:b8:ba:ca:a1:15:c1:9b:77:25:9a:a0:fc:4f:9e:e2:a0:6e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

flpjwszh
Size: 908KB - Virtual size: 908KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

njrtwlcx
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nossvc.exe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

87:b5:74:c6:c2:f8:33:41:b1:9b:dd:8c:94:0a:18:1c:bf:70:14:e0:03:c8:b1:5d:57:81:30:33:01:10:f1:4a
Signer

Actual PE Digest

87:b5:74:c6:c2:f8:33:41:b1:9b:dd:8c:94:0a:18:1c:bf:70:14:e0:03:c8:b1:5d:57:81:30:33:01:10:f1:4a

Digest Algorithm

sha256

PE Digest Matches

true

87:c4:90:99:b2:7b:27:fc:6a:f6:15:fc:9e:4c:3e:4a:fb:fc:6b:f8
Signer

Actual PE Digest

87:c4:90:99:b2:7b:27:fc:6a:f6:15:fc:9e:4c:3e:4a:fb:fc:6b:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 728KB - Virtual size: 728KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

gedjxhrz
Size: 892KB - Virtual size: 892KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nlrywlll
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npUpdateC.exe
.exe windows:4 windows x86 arch:x86

98c000aeceae5324c5d9d2fdb904dd0d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:69:0d:06:9f:6e:fd:74:80:21:b9:7c:00:37:10:b5:14:7d:6b:2c:a5:27:21:15:60:d7:fe:37:3f:c3:2d:fd
Signer

Actual PE Digest

1f:69:0d:06:9f:6e:fd:74:80:21:b9:7c:00:37:10:b5:14:7d:6b:2c:a5:27:21:15:60:d7:fe:37:3f:c3:2d:fd

Digest Algorithm

sha256

PE Digest Matches

true

33:e9:a5:dc:ed:4a:2e:c4:6c:ab:09:b9:45:bb:05:96:a0:d6:1f:03
Signer

Actual PE Digest

33:e9:a5:dc:ed:4a:2e:c4:6c:ab:09:b9:45:bb:05:96:a0:d6:1f:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\001_build\npUpdate\npUpdater\bin\releaseu\npUpdateC.pdb

Imports

shlwapi

PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

kernel32

GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcessId
CreateEventA
VirtualFree
GetProcAddress
GetLastError
CloseHandle
DeleteFileW
FreeLibrary
LoadLibraryW
SetHandleCount
FindResourceW
LoadResource
GetCurrentProcess
LockResource
SizeofResource
CreateFileW
WriteFile
Sleep
GetUserDefaultUILanguage
GlobalAlloc
FreeResource
SetEvent
CreateEventW
ResetEvent
WaitForSingleObject
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
ResumeThread
MultiByteToWideChar
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetLocalTime
LocalAlloc
HeapCreate
HeapDestroy
GetStartupInfoA
CreateMutexW
GetFileType
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualQuery
VirtualAlloc
MoveFileExW
RemoveDirectoryW
GetModuleFileNameW
CopyFileW
InterlockedCompareExchange
CreateMutexA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
VirtualProtect
HeapSize
RaiseException
HeapReAlloc
ExitProcess
RtlUnwind
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
SetErrorMode
lstrlenA
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
GetFileTime
SystemTimeToFileTime
GetVolumeInformationW
DuplicateHandle
FlushFileBuffers
GetThreadLocale
GetStringTypeExW
InterlockedDecrement
WritePrivateProfileStringW
GlobalFindAtomW
CompareStringW
GetVersionExA
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
UnlockFile
LockFile
IsBadReadPtr
LoadLibraryExW
GetStdHandle
lstrlenW
GetFullPathNameW
SetFileTime
SetEndOfFile
SetFilePointer
LoadLibraryA
OpenMutexW
ReadFile
GetFileSize
SetLastError
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindFirstFileW
CreateDirectoryW
CreateProcessW
TerminateProcess
ProcessIdToSessionId
FormatMessageA
GetModuleHandleW
GetModuleHandleA
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
GetSystemInfo
GetVersion
QueryPerformanceFrequency
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FormatMessageW
OutputDebugStringW
QueryPerformanceCounter
WideCharToMultiByte
DeviceIoControl
CreateFileA
GetTickCount
MoveFileW

user32

UnregisterClassA
PostThreadMessageW
RegisterClipboardFormatW
UnregisterClassW
MessageBeep
SetCapture
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
CharNextW
DestroyMenu
LoadCursorW
GetSysColorBrush
CharUpperW
GetMessageW
TranslateMessage
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
GetPropW
RemovePropW
SetActiveWindow
DispatchMessageW
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
PtInRect
DefWindowProcW
CallWindowProcW
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
GetLastActivePopup
IsWindowEnabled
SetCursor
EndPaint
BeginPaint
GetWindowDC
ScreenToClient
PostQuitMessage
GetTopWindow
GetForegroundWindow
ExitWindowsEx
GetWindow
GetWindowTextLengthW
IsWindowVisible
GetWindowThreadProcessId
MessageBoxW
DrawFocusRect
OffsetRect
DrawEdge
PostMessageW
GetNextDlgGroupItem
ReleaseCapture
WindowFromPoint
GetCursorPos
GetCapture
GetWindowLongW
ClientToScreen
GetParent
SetRect
GetDC
ReleaseDC
GetClassNameW
LoadBitmapW
LoadImageW
SetWindowRgn
TabbedTextOutW
IsIconic
GetKeyState
FillRect
LoadIconW
GetSysColor
InflateRect
GetClassLongW
WindowFromDC
InvalidateRect
IsWindow
CopyRect
GrayStringW
DrawIcon
FindWindowW
DrawTextExW
GetClientRect
GetDesktopWindow
DrawTextW
GetSystemMetrics
GetWindowRect
SendMessageW
EnableWindow
SetPropW
LoadStringW

gdi32

CreateCompatibleBitmap
GetMapMode
GetWindowExtEx
Escape
SelectObject
GetViewportExtEx
DPtoLP
PtVisible
GetStockObject
RectVisible
CreateFontW
GetBkColor
TextOutW
CreateCompatibleDC
BitBlt
ExtTextOutW
LPtoDP
CreateRectRgn
CombineRgn
GetPixel
DeleteObject
GetObjectW
CreateSolidBrush
SetPixel
StretchBlt
DeleteDC
GetDeviceCaps
CreateFontIndirectW
SelectClipRgn
SaveDC
RestoreDC
SetBkColor
SetBkMode
SetTextColor
SetMapMode
GetClipBox
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateBitmap
ScaleViewportExtEx
CreateRectRgnIndirect
GetTextColor
GetRgnBox
SetWindowOrgEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

GetTokenInformation
GetUserNameW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RevertToSelf
RegQueryValueW
RegEnumKeyW
EnumDependentServicesW
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
ConvertSidToStringSidW
OpenSCManagerW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
RegOpenKeyW
GetSidSubAuthorityCount
IsValidSid
GetSidSubAuthority
GetSidIdentifierAuthority
LookupAccountSidW
CreateProcessAsUserW
SetKernelObjectSecurity
MakeAbsoluteSD
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
ImpersonateLoggedOnUser
SetSecurityDescriptorDacl
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
RegCloseKey
RegQueryValueExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHAppBarMessage

comctl32

_TrackMouseEvent
InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
CreateStreamOnHGlobal
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal

oleaut32

OleLoadPicture
SysAllocString
VariantClear
VariantCopy
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringLen
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
GetBestRoute

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wintrust

WinVerifyTrust

crypt32

CryptQueryObject
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringW

netapi32

NetGetJoinInformation
NetApiBufferFree
NetLocalGroupGetMembers

wininet

InternetSetOptionW
HttpOpenRequestW
InternetCloseHandle
FtpGetFileSize
HttpSendRequestW
HttpQueryInfoW
FtpOpenFileW
InternetReadFile
InternetQueryDataAvailable
InternetConnectW
InternetOpenW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

inet_ntoa
inet_addr

Sections

.text
Size: 940KB - Virtual size: 938KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npcf_win_32u.dll
.dll windows:4 windows x86 arch:x86

e173053aab7169b17490d0773c9dff4a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\docs\암호모듈검증_프로젝트\제출물\nprotect_crypto_v1.1_2014.07.14\source\winodws\dll\release\npcf_win_32u.pdb

Imports

kernel32

GetTickCount
GetProcessHeap
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryW
QueryPerformanceFrequency
GetCurrentThreadId
CloseHandle
GetVersionExW
GetCurrentProcessId
GetSystemTime
FreeLibrary
QueryPerformanceCounter
GetProcAddress
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingW
GetFileSize
DuplicateHandle
GetCurrentProcess
OpenProcess
Sleep
CreateThread
TerminateThread
LCMapStringW
LCMapStringA
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA

user32

FindWindowW
GetSystemMetrics
GetCursorPos

ole32

CoCreateGuid

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npeUpdate.xml
npealert.npd
.dll windows:4 windows x86 arch:x86

11e80d783924802e6cd9440934cb980c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:6d:ea:94:71:02:5d:9f:cf:e9:bd:65:d5:25:14:ba:59:63:ef:24:a9:d5:1e:4d:09:16:b1:03:eb:46:41:20
Signer

Actual PE Digest

68:6d:ea:94:71:02:5d:9f:cf:e9:bd:65:d5:25:14:ba:59:63:ef:24:a9:d5:1e:4d:09:16:b1:03:eb:46:41:20

Digest Algorithm

sha256

PE Digest Matches

true

bb:54:12:1d:33:9d:68:16:1f:73:76:4d:d4:26:20:71:bc:37:ac:9b
Signer

Actual PE Digest

bb:54:12:1d:33:9d:68:16:1f:73:76:4d:d4:26:20:71:bc:37:ac:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npealert\build\bin\release\npealert.pdb

Imports

psapi

GetModuleBaseNameW

shlwapi

PathFileExistsW
PathFindFileNameW
PathFindExtensionW
PathIsDirectoryW
PathRemoveBackslashW

kernel32

SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
VirtualAlloc
RtlUnwind
ExitThread
CreateThread
ExitProcess
RaiseException
HeapSize
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
UnhandledExceptionFilter
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringW
FlushFileBuffers
GetThreadLocale
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
MulDiv
FreeResource
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
InterlockedDecrement
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
LoadLibraryExW
lstrcmpW
GlobalAddAtomW
SuspendThread
SetThreadPriority
GetWindowsDirectoryW
lstrcpynW
lstrlenW
GlobalAlloc
InterlockedExchange
GlobalUnlock
GlobalFree
GlobalLock
IsBadReadPtr
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
HeapFree
GetProcessHeap
HeapAlloc
GetSystemInfo
VerifyVersionInfoW
VerSetConditionMask
GetVersion
WriteFile
CreateFileW
ReleaseMutex
OpenMutexW
CreateMutexW
MoveFileW
DeleteFileW
GetFileSize
SetFilePointer
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FormatMessageW
OutputDebugStringW
MultiByteToWideChar
SetLastError
OpenProcess
CreateProcessW
Process32NextW
Sleep
LocalFree
Process32FirstW
CreateToolhelp32Snapshot
FreeLibrary
LoadLibraryW
LocalAlloc
GetDriveTypeW
ReadFile
GetCurrentProcess
GetCurrentProcessId
ProcessIdToSessionId
TerminateProcess
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
GetModuleFileNameW
EnumUILanguagesW
GetLocaleInfoW
GetUserDefaultUILanguage
GetProcAddress
GetModuleHandleW
GetUserDefaultLCID
GetModuleHandleA
GetLocalTime
MapViewOfFile
CreateFileMappingW
GetLastError
UnmapViewOfFile
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
SizeofResource
CloseHandle
CreateEventW
TerminateThread
WaitForSingleObject
ResumeThread
SetEvent
HeapCreate

user32

GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
IsDialogMessageW
CreateDialogIndirectParamW
EndDialog
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextW
SetActiveWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
GetScrollRange
SetScrollPos
GetScrollPos
GetMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
SetScrollInfo
GetDlgCtrlID
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
IsWindowEnabled
UnhookWindowsHookEx
PostQuitMessage
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyState
PeekMessageW
SetMenuItemBitmaps
DestroyWindow
GetNextDlgTabItem
DestroyMenu
GrayStringW
DrawTextExW
TabbedTextOutW
GetSubMenu
GetActiveWindow
DefWindowProcW
GetClassInfoW
WindowFromPoint
InflateRect
SetWindowTextW
MoveWindow
ShowWindow
TrackMouseEvent
DrawFocusRect
GetFocus
InvalidateRect
ReleaseDC
ScreenToClient
FillRect
SetCursor
GetSysColor
GetCursorPos
DestroyCursor
CopyIcon
SetWindowLongW
BeginPaint
EndPaint
LoadCursorW
CopyRect
UnregisterClassW
GetSysColorBrush
GetScrollInfo
GetDC
GetWindowLongW
GetWindow
GetWindowTextLengthW
DestroyIcon
SystemParametersInfoW
IsWindow
DrawTextW
FindWindowW
PtInRect
ClientToScreen
GetForegroundWindow
GetWindowThreadProcessId
GetSystemMetrics
RedrawWindow
GetDesktopWindow
GetWindowRect
IsWindowVisible
PostMessageW
LoadIconW
SetFocus
BringWindowToTop
SetForegroundWindow
SetWindowPos
AttachThreadInput
SetRect
EnableWindow
SendMessageW
GetParent
GetClientRect
UpdateWindow
PostThreadMessageW
MessageBoxW
ValidateRect
GetLastActivePopup
UnregisterClassA

gdi32

SaveDC
GetClipBox
Escape
CreateBitmap
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetMapMode
Rectangle
GetTextColor
StretchBlt
PtVisible
RectVisible
RestoreDC
ExtTextOutW
SelectObject
GetObjectW
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetStockObject
DeleteObject
DeleteDC
SetBkColor
TextOutW
CreatePen
MoveToEx
LineTo
CreateSolidBrush
GetTextExtentPoint32W
GetCurrentObject
SetTextJustification
GetTextMetricsW
SetTextColor
SetBkMode
BeginPath
RoundRect
SetPixel
EndPath
GetPixel

msimg32

TransparentBlt
GradientFill

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

LookupAccountSidW
CreateProcessAsUserW
RegEnumKeyW
RegQueryValueW
RegCreateKeyExW
ConvertSidToStringSidW
RegOpenKeyW
RegDeleteKeyW
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSid
GetSidIdentifierAuthority
SetNamedSecurityInfoW
ImpersonateLoggedOnUser
GetSidSubAuthorityCount
GetSidSubAuthority
SetKernelObjectSecurity
SetSecurityDescriptorDacl
MakeAbsoluteSD
SetEntriesInAclW
BuildExplicitAccessWithNameW
AdjustTokenPrivileges
GetUserNameW
LookupPrivilegeValueW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
RegCloseKey
RegSetValueExW
GetLengthSid
SetTokenInformation
ConvertStringSidToSidW
RegOpenKeyExW
DuplicateTokenEx
GetTokenInformation
RevertToSelf
OpenProcessToken

shell32

SHAppBarMessage
ExtractIconW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

comctl32

_TrackMouseEvent
ImageList_GetIconSize

ole32

CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdipCreateSolidFill
GdipDeleteBrush
GdipAlloc
GdipCloneBrush
GdipFree
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipDeletePen
GdipDrawLine
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFillRectangleI
GdipGetDC
GdipReleaseDC
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateBitmapFromHICON
GdipDeleteFont
GdipCloneFont
GdipSetSmoothingMode
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipCloneBitmapAreaI
ord1
GdipClosePathFigure
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipFillPath
GdipAddPathLine
GdipSetTextRenderingHint
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipDrawImageRectRectI
GdipFillPolygonI
GdipDrawRectangleI
GdipCreateLineBrushFromRectI
GdipSetPenColor
GdipSetLineColors
GdipCreateFromHDC
GdipCreateBitmapFromFile
GdipCreateFont

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wintrust

WinVerifyTrust

Exports

Exports

AddType1Alert
CreateType1Alert
Type1Alert
Type2Alert
_DestoryType1Alert@4
addNpeAlert
createNpeAlert
createNpeBasicAlert
createNpePopupAlert
loadNpeAlertPolicy
unloadNpeAlertPolicy

Sections

.text
Size: 540KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npebsc20.npd
.dll windows:4 windows x86 arch:x86

d7b982bd5b1c96f920297a33bc140e3d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:39:77:1d:e7:71:b6:7a:b1:8d:0c:73:17:cc:d1:f7:b2:8f:44:e5:7a:cc:c9:d0:33:06:b2:77:67:12:91:f5
Signer

Actual PE Digest

22:39:77:1d:e7:71:b6:7a:b1:8d:0c:73:17:cc:d1:f7:b2:8f:44:e5:7a:cc:c9:d0:33:06:b2:77:67:12:91:f5

Digest Algorithm

sha256

PE Digest Matches

true

ed:61:9c:a1:20:2d:ac:d0:33:bc:6e:21:ca:69:65:c7:86:c2:80:44
Signer

Actual PE Digest

ed:61:9c:a1:20:2d:ac:d0:33:bc:6e:21:ca:69:65:c7:86:c2:80:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npEngine\npebsc20\build\bin\release\npebsc20.pdb

Imports

kernel32

FindFirstFileW
FindClose
MoveFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
WriteFile
ReadFile
SetFilePointer
FormatMessageW
LocalFree
Sleep
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ReleaseMutex
OutputDebugStringW
GetUserDefaultUILanguage
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetCurrentProcess
GetModuleHandleW
GetSystemInfo
GetModuleFileNameW
GetFileSize
SetEvent
CreateMutexW
OpenMutexW
GetProcessHeap
HeapFree
HeapAlloc
LocalAlloc
SetLastError
CreateToolhelp32Snapshot
Process32FirstW
DeleteFileW
OpenProcess
TerminateProcess
ProcessIdToSessionId
GetCurrentProcessId
GetDateFormatW
GetTimeFormatW
EnumUILanguagesW
WideCharToMultiByte
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CreateEventA
CreateMutexA
MultiByteToWideChar
CloseHandle
GetModuleHandleA
FreeLibrary
GetProcAddress
GetLastError
Process32NextW
LoadLibraryW

user32

MessageBoxW
GetSystemMetrics
UnregisterClassA
IsWindow

shlwapi

PathRemoveBackslashW
PathFileExistsW
PathIsDirectoryW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

wintrust

WinVerifyTrust

netapi32

NetGetJoinInformation
NetLocalGroupGetMembers
NetApiBufferFree

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptMsgGetParam
CryptQueryObject
CertFindCertificateInStore

advapi32

RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthority
RegQueryValueExW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
GetUserNameW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sections

.text
Size: 308KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npefsav.npd
.dll windows:4 windows x86 arch:x86

35ae1131bb210c35f49af1a747e80263

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:5a:cf:fc:31:ed:a9:66:a7:90:60:dd:75:70:df:92:2a:f3:02:1b:93:1a:70:68:e7:d2:fd:07:b0:00:d7:8b
Signer

Actual PE Digest

7d:5a:cf:fc:31:ed:a9:66:a7:90:60:dd:75:70:df:92:2a:f3:02:1b:93:1a:70:68:e7:d2:fd:07:b0:00:d7:8b

Digest Algorithm

sha256

PE Digest Matches

true

1e:4a:b4:71:a4:ce:f1:94:a7:ff:d2:57:68:33:18:b3:75:b5:2f:b8
Signer

Actual PE Digest

1e:4a:b4:71:a4:ce:f1:94:a7:ff:d2:57:68:33:18:b3:75:b5:2f:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npEngine\npefsav\build\bin\release\npefsav.pdb

Imports

kernel32

ProcessIdToSessionId
GetCurrentProcess
GetModuleHandleW
ReadFile
LocalAlloc
GetModuleFileNameW
CreateDirectoryW
GetProcessHeap
HeapFree
HeapAlloc
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetUserDefaultUILanguage
EnumUILanguagesW
SetFileAttributesW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
CreateFileW
WriteFile
SetLastError
MultiByteToWideChar
GetLocalTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
FormatMessageW
WideCharToMultiByte
CreateMutexW
OpenMutexW
ReleaseMutex
SetFilePointer
Module32FirstW
MoveFileW
VerSetConditionMask
VerifyVersionInfoW
GetSystemInfo
SetEvent
GetFileAttributesW
IsBadReadPtr
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
WaitForSingleObject
CreateEventA
TlsAlloc
TlsFree
TlsGetValue
CreateMutexA
TlsSetValue
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo
LCMapStringA
LCMapStringW
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
TerminateProcess
GetLastError
OpenProcess
LocalFree
Sleep
GetSystemTimeAsFileTime
Module32NextW
CopyFileW
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetCurrentProcessId
Process32NextW
CloseHandle
Process32FirstW
GetFileSize
CreateToolhelp32Snapshot

user32

MessageBoxW
IsWindow

psapi

GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathIsDirectoryW
PathRemoveBackslashW
PathFileExistsW

crypt32

CertFindCertificateInStore
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam
CertFreeCertificateContext

netapi32

NetApiBufferFree
NetLocalGroupGetMembers
NetGetJoinInformation

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

advapi32

GetTokenInformation
GetSidSubAuthority
OpenProcessToken
AdjustTokenPrivileges
SetSecurityDescriptorDacl
LookupPrivilegeValueW
ConvertSidToStringSidW
RegQueryInfoKeyW
RegQueryValueExW
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
GetUserNameW
RegCloseKey
GetSidSubAuthorityCount

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Exports

Exports

fn_getVersion

Sections

.text
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npefw.npd
.dll windows:4 windows x86 arch:x86

2d0001485ee091b39819f934a61641bb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:69:2b:92:ee:f1:bc:f7:4d:a0:a5:8d:0f:bc:19:47:ea:df:65:8d:ec:3f:c8:d9:84:22:98:f7:af:78:1d:62
Signer

Actual PE Digest

13:69:2b:92:ee:f1:bc:f7:4d:a0:a5:8d:0f:bc:19:47:ea:df:65:8d:ec:3f:c8:d9:84:22:98:f7:af:78:1d:62

Digest Algorithm

sha256

PE Digest Matches

true

f9:45:84:7c:e3:36:09:fc:64:6e:49:06:59:9b:5f:4a:14:71:8c:77
Signer

Actual PE Digest

f9:45:84:7c:e3:36:09:fc:64:6e:49:06:59:9b:5f:4a:14:71:8c:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npEngine\npefw\build\bin\release\npefw.pdb

Imports

kernel32

CloseHandle
CopyFileW
GetModuleHandleA
GetModuleHandleW
HeapFree
GetProcessHeap
CreateFileW
GetFileSize
ReadFile
WriteFile
SetFilePointer
SetLastError
DeleteFileW
MoveFileW
FindClose
GetFileAttributesW
SetFileAttributesW
FindFirstFileW
MultiByteToWideChar
CreateDirectoryW
FormatMessageW
LocalFree
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventA
HeapAlloc
GetSystemTimeAsFileTime
CreateEventW
WaitForSingleObject
SetEvent
ResetEvent
GetUserDefaultUILanguage
GetLocalTime
ReleaseMutex
VerSetConditionMask
VerifyVersionInfoW
FreeLibrary
GetSystemInfo
CreateMutexW
OpenMutexW
GetModuleFileNameW
LocalAlloc
GetSystemDirectoryA
LoadLibraryA
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
TerminateProcess
GetDateFormatW
GetTimeFormatW
EnumUILanguagesW
FileTimeToSystemTime
GetFileAttributesExW
FileTimeToLocalFileTime
FindNextFileW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
TlsAlloc
TlsFree
TlsGetValue
CreateMutexA
TlsSetValue
ResumeThread
GetTickCount
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo
LCMapStringA
LCMapStringW
ExitProcess
ExitThread
CreateThread
GetStdHandle
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
OutputDebugStringW
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetLastError
WideCharToMultiByte
GetSystemDirectoryW
GetCurrentProcess
Sleep

user32

IsWindow
IsWindowVisible
MessageBoxW
SendMessageW
UnregisterClassA

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW
StrToIntW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

ws2_32

WSASetLastError
WSACleanup
WSAStartup
htonl
gethostbyaddr
getservbyport
htons
ntohs
inet_addr
gethostbyname
WSAGetLastError
getservbyname
inet_ntoa

wintrust

WinVerifyTrust

netapi32

NetApiBufferFree
NetLocalGroupGetMembers
NetGetJoinInformation

crypt32

CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
QueryServiceStatus
OpenServiceW
CloseServiceHandle
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertSidToStringSidW
GetUserNameW
OpenSCManagerW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthority
GetTokenInformation

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sections

.text
Size: 492KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npertd.npd
.dll windows:4 windows x86 arch:x86

27eac47c7a2c7c8e5d1e4fc0f3155d65

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

cc:fd:03:5c:d9:73:c6:8d:53:b4:38:b6:bb:98:98:b5:9e:bb:fa:85:18:fd:ec:f2:41:53:5a:a8:ea:6f:60:af
Signer

Actual PE Digest

cc:fd:03:5c:d9:73:c6:8d:53:b4:38:b6:bb:98:98:b5:9e:bb:fa:85:18:fd:ec:f2:41:53:5a:a8:ea:6f:60:af

Digest Algorithm

sha256

PE Digest Matches

true

f0:3a:58:85:66:6c:9b:33:cf:d6:14:77:a5:ca:1a:9f:c6:93:4e:a3
Signer

Actual PE Digest

f0:3a:58:85:66:6c:9b:33:cf:d6:14:77:a5:ca:1a:9f:c6:93:4e:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npEngine\npertd\build\bin\release\npertd.pdb

Imports

kernel32

GetWindowsDirectoryW
GetTickCount
InitializeCriticalSection
OpenProcess
ExpandEnvironmentStringsW
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindClose
lstrlenW
CreateFileW
WriteFile
GetVolumeInformationW
GetModuleHandleA
GetDriveTypeW
LocalFree
LeaveCriticalSection
GetLastError
EnterCriticalSection
FindFirstFileW
GetModuleHandleW
GetLongPathNameW
FreeLibrary
LocalAlloc
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetCurrentProcessId
SetLastError
FlushFileBuffers
ReadFile
CreateEventW
SetEvent
ResetEvent
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
MoveFileW
SetFileAttributesW
SetFilePointer
FormatMessageW
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetUserDefaultUILanguage
GetLocalTime
GetFileAttributesW
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcess
GetSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
CreateEventA
GetModuleFileNameW
GetFileSize
ReleaseMutex
CreateMutexW
OpenMutexW
Module32FirstW
Module32NextW
ProcessIdToSessionId
TerminateProcess
FindNextFileW
GetDateFormatW
GetTimeFormatW
EnumUILanguagesW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TlsAlloc
TlsFree
TlsGetValue
CreateMutexA
TlsSetValue
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ExitProcess
ExitThread
CreateThread
GetStdHandle
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
DeleteFileW
Sleep
DeleteCriticalSection

user32

MessageBoxW
IsWindow
UnregisterClassA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
SetSecurityInfo
GetUserNameW
ConvertSidToStringSidW
GetTokenInformation
GetSidSubAuthority
LookupPrivilegeValueW
AdjustTokenPrivileges
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
RevertToSelf
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
ImpersonateLoggedOnUser
GetSidSubAuthorityCount

shlwapi

PathRemoveBackslashW
PathFileExistsW
PathIsDirectoryW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW

wintrust

WinVerifyTrust

netapi32

NetApiBufferFree
NetLocalGroupGetMembers
NetGetJoinInformation

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertGetNameStringW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sections

.text
Size: 416KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npeurlmon.npd
.dll windows:4 windows x86 arch:x86

61f39e02b0b2fb28a74f120503373225

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

de:18:09:22:27:c9:55:3a:ad:84:62:9e:ca:8b:83:04:94:c6:89:43:08:fd:5c:88:78:b5:26:d3:90:75:ed:03
Signer

Actual PE Digest

de:18:09:22:27:c9:55:3a:ad:84:62:9e:ca:8b:83:04:94:c6:89:43:08:fd:5c:88:78:b5:26:d3:90:75:ed:03

Digest Algorithm

sha256

PE Digest Matches

true

7c:0a:3c:ae:62:7d:1f:08:cd:ee:1c:ac:4f:39:0c:1e:6d:3e:97:f8
Signer

Actual PE Digest

7c:0a:3c:ae:62:7d:1f:08:cd:ee:1c:ac:4f:39:0c:1e:6d:3e:97:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npeurlmon\npeurlmon\build\bin\release\npeurlmon.pdb

Imports

kernel32

GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
ResumeThread
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
CreateMutexA
InterlockedCompareExchange
GetFileAttributesExW
EnumUILanguagesW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
VerSetConditionMask
VerifyVersionInfoW
FreeEnvironmentStringsW
GetUserDefaultUILanguage
GetLocalTime
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
CreateDirectoryW
FormatMessageW
FreeLibrary
InterlockedDecrement
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GlobalLock
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
lstrlenW
WideCharToMultiByte
GetCurrentProcessId
GetModuleFileNameW
FindResourceW
LoadResource
LockResource
SizeofResource
SetLastError
OpenMutexW
ReleaseMutex
OutputDebugStringW
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
CloseHandle
HeapAlloc
SetEvent
CreateEventA
ResetEvent
CreateEventW
WaitForSingleObject
CreateMutexW
GetModuleHandleW
GetLastError
GetProcAddress
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentThreadId
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
Sleep
ExitProcess
HeapSize
HeapReAlloc
CreateThread
ExitThread
RtlUnwind
RaiseException
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileAttributesW
SetFileAttributesW
FileTimeToLocalFileTime
CreateFileW
FindFirstFileW
FindClose
GetCurrentProcess
GetFileSize
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetStringTypeExW
DeleteFileW
MoveFileW
InterlockedExchange
GetModuleHandleA
GlobalFlags
SystemTimeToFileTime
FileTimeToSystemTime
GetThreadLocale
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
lstrcmpW
GetVersionExA
GetVersion
InterlockedIncrement
MultiByteToWideChar

user32

GetClientRect
GetMenu
PostMessageW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
SetForegroundWindow
CopyRect
PtInRect
GetDlgCtrlID
GetForegroundWindow
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
RemovePropW
GetPropW
SetPropW
GetClassLongW
GetCapture
WinHelpW
SetWindowTextW
ClientToScreen
DestroyMenu
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
MapWindowPoints
GetMessagePos
GetMessageTime
GetTopWindow
GetDlgItem
CheckMenuItem
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
GetKeyState
PeekMessageW
CallWindowProcW
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageW
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
PostQuitMessage
CreateWindowExW
RegisterClassW
DispatchMessageW
LoadIconW
LoadCursorW
GetWindow
DestroyWindow
DefWindowProcW
GetParent
SendMessageTimeoutW
RegisterWindowMessageW
IsWindow
FindWindowExW
IsIconic
EnumWindows
UnregisterClassA
LoadStringW
EnumChildWindows
GetWindowTextW
GetClassNameW
IsWindowVisible

gdi32

RestoreDC
SaveDC
ExtTextOutW
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
GetStockObject
PtVisible
RectVisible
TextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetMapMode

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

SetSecurityDescriptorDacl
IsValidSid
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetSidIdentifierAuthority
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
InitializeSecurityDescriptor

shell32

SHGetFolderPathW

ole32

CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

VariantChangeType
SysFreeString
VariantClear
VariantInit

shlwapi

PathFileExistsW
PathIsDirectoryW

psapi

GetModuleBaseNameW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleChildren
AccessibleObjectFromWindow

Exports

Exports

addClient
addExceptHwnd
delExceptHwnd
deleteClient
getBrowserUrl
ignoreClient
isClientListEmpty
isExistClient
isMonitoring
npInitAPSCallback
npInitDomainCallback
npInitUrlMonitor
npStartSingleUrlMonitor
npStartUrlMonitor
npStopUrlMonitor
setBrowserType

Sections

.text
Size: 440KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npk/INICRYPTOSDK.dll
.dll windows:4 windows x86 arch:x86

2702bc403da1fe9704553a4d4c0969fd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:c3:03:2a:76:58:b7:b8:f2:61:7d:18:32:aa:07:a5:34:7d:90:c7:b3:14:e8:5b:45:2b:8f:31:7c:69:8a:35
Signer

Actual PE Digest

44:c3:03:2a:76:58:b7:b8:f2:61:7d:18:32:aa:07:a5:34:7d:90:c7:b3:14:e8:5b:45:2b:8f:31:7c:69:8a:35

Digest Algorithm

sha256

PE Digest Matches

true

f0:ee:30:1a:13:ae:0a:9e:ce:97:1c:6c:38:23:0c:8a:0e:9c:07:1b
Signer

Actual PE Digest

f0:ee:30:1a:13:ae:0a:9e:ce:97:1c:6c:38:23:0c:8a:0e:9c:07:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord2764
ord4465
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord6467
ord1578
ord600
ord826
ord269
ord3259
ord3147
ord2982
ord3953
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1168
ord1575
ord1577
ord1176
ord1116
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord538
ord858
ord860
ord537
ord540
ord2915
ord5572
ord535
ord800

msvcrt

signal
??2@YAPAXI@Z
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
fputs
memmove
fgets
fseek
ftell
_setmode
fflush
fwrite
_errno
sscanf
getenv
time
_ftol
strtoul
_fileno
strncmp
fprintf
memchr
printf
realloc
_isctype
__mb_cur_max
_pctype
tolower
_iob
vfprintf
_vsnprintf
wcsstr
abort
sprintf
strncpy
memcmp
fopen
fread
fclose
strcpy
free
malloc
memset
memcpy
strcmp
strstr
strchr
strlen
__CxxFrameHandler
qsort
_getch

kernel32

GetStdHandle
LocalFree
GetCurrentProcessId
FlushConsoleInputBuffer
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetTickCount
CloseHandle
QueryPerformanceCounter
GlobalMemoryStatus
GetFileType
GetVersion
LocalAlloc
GetCurrentThreadId
GetLastError

user32

GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

Exports

Exports

DecEncKey
EncData
EncKeyWithPubkey
EncRandKey
GetKey
GetRandData
freeData

Sections

.text
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noska.sys
.sys windows:6 windows x86 arch:x86

848f63553a9a79bfa946f6e3fd4cc6d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxa\npkakl\npkfxa\objfre\i386\noska.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
ZwQuerySystemInformation
RtlUpcaseUnicodeStringToOemString
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
MmIsAddressValid
ObQueryNameString
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlFreeOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskcp.dll
.dll windows:4 windows x86 arch:x86

5725f9cfa32a9055e5ee66de9b62eca8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:b8:89:4d:2c:25:04:f4:08:48:b6:c3:b5:56:f7:37:7a:93:34:c7:df:c9:78:ba:a5:f4:66:10:65:c5:33:a7
Signer

Actual PE Digest

90:b8:89:4d:2c:25:04:f4:08:48:b6:c3:b5:56:f7:37:7a:93:34:c7:df:c9:78:ba:a5:f4:66:10:65:c5:33:a7

Digest Algorithm

sha256

PE Digest Matches

true

c9:5a:6b:fe:02:d6:06:bb:5f:25:5e:54:05:ab:b1:ed:ba:23:ac:56
Signer

Actual PE Digest

c9:5a:6b:fe:02:d6:06:bb:5f:25:5e:54:05:ab:b1:ed:ba:23:ac:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\source\nosk\dll\noskcp\release\noskcp.pdb

Imports

msvcp80

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

msvcr80

_fileno
ftell
feof
_setmode
fgets
strcmp
isxdigit
getenv
isupper
sscanf
atoi
_gmtime64
fprintf
sprintf
strstr
fputs
signal
_getch
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
fflush
fwrite
fread
ferror
fclose
fopen
_wfopen
_errno
_time64
strncmp
_strnicmp
isdigit
qsort
strchr
strncpy
__iob_func
raise
_exit
_vsnprintf
wcsstr
malloc
realloc
free
tolower
isspace
strtoul
memmove
memcpy
memset
_invalid_parameter_noinfo
??3@YAXPAX@Z
fseek
__CxxFrameHandler3

kernel32

GetCurrentThreadId
GetProcAddress
GetModuleHandleA
GetVersion
WriteFile
GetFileType
GetStdHandle
MultiByteToWideChar
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
CloseHandle
FreeLibrary
LoadLibraryA
FlushConsoleInputBuffer
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

Sections

.text
Size: 380KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskcv.dll
.dll windows:4 windows x86 arch:x86

55e7f58250c447b99a1a9cfd4f0ae289

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:28:a4:d7:d1:55:55:7e:d9:cd:14:a0:a9:ca:11:97:1a:e2:de:62:09:aa:7b:89:27:95:c6:f6:22:38:a9:d1
Signer

Actual PE Digest

0d:28:a4:d7:d1:55:55:7e:d9:cd:14:a0:a9:ca:11:97:1a:e2:de:62:09:aa:7b:89:27:95:c6:f6:22:38:a9:d1

Digest Algorithm

sha256

PE Digest Matches

true

45:9b:0a:b4:8d:7a:f2:8c:75:98:6c:d0:37:48:25:c2:d6:43:61:0b
Signer

Actual PE Digest

45:9b:0a:b4:8d:7a:f2:8c:75:98:6c:d0:37:48:25:c2:d6:43:61:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\source\nosk\dll\noskcv\release\noskcv.pdb

Imports

kernel32

DeleteCriticalSection
CreateEventW
SetEvent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetTickCount
GetCurrentProcessId
WriteFile
InitializeCriticalSection
ConnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
GetOverlappedResult
LocalFree
SetLastError
CreateNamedPipeW
CreateFileW
FlushFileBuffers
SetThreadPriority
Sleep
GetLastError
TerminateThread
CreateThread
ReadFile
WaitForSingleObject
CreateFileA
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorSacl

ole32

CoInitialize
CoCreateGuid

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskcv64.dll
.dll windows:4 windows x64 arch:x64

99e1a801ef9b18f828cc824550c160a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:e3:8d:d6:5f:06:e9:a6:a9:45:27:a5:fc:10:62:de:5f:00:6a:3c:e3:b2:35:ba:b8:30:0d:86:fa:37:98:fa
Signer

Actual PE Digest

9d:e3:8d:d6:5f:06:e9:a6:a9:45:27:a5:fc:10:62:de:5f:00:6a:3c:e3:b2:35:ba:b8:30:0d:86:fa:37:98:fa

Digest Algorithm

sha256

PE Digest Matches

true

c2:a5:b8:91:ef:5a:68:cd:be:6c:83:74:16:ac:4b:09:1a:ea:1b:51
Signer

Actual PE Digest

c2:a5:b8:91:ef:5a:68:cd:be:6c:83:74:16:ac:4b:09:1a:ea:1b:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskcv\release\noskcv64.pdb

Imports

kernel32

CloseHandle
EnterCriticalSection
LeaveCriticalSection
ResetEvent
WaitForSingleObject
CreateThread
TerminateThread
GetTickCount
GetCurrentProcessId
SetLastError
SetEvent
CreateFileW
FlushFileBuffers
WriteFile
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
GetOverlappedResult
LocalFree
SetThreadPriority
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
Sleep
CreateNamedPipeW
GetLastError
CreateFileA
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
HeapFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetModuleHandleA
GetProcAddress
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CoInitialize
CoCreateGuid

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noske64.exe
.exe windows:4 windows x64 arch:x64

5c92c477f1f8e4e759097df007461402

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:c5:d1:a0:3e:35:e3:01:14:84:33:67:3f:22:9a:2d:51:ba:2a:96:e0:e3:48:ec:0b:e0:d2:7b:89:45:cb:9d
Signer

Actual PE Digest

01:c5:d1:a0:3e:35:e3:01:14:84:33:67:3f:22:9a:2d:51:ba:2a:96:e0:e3:48:ec:0b:e0:d2:7b:89:45:cb:9d

Digest Algorithm

sha256

PE Digest Matches

true

c6:71:dc:59:53:b7:0d:5c:e4:c0:1f:6e:a9:12:e2:3a:c0:db:f6:e1
Signer

Actual PE Digest

c6:71:dc:59:53:b7:0d:5c:e4:c0:1f:6e:a9:12:e2:3a:c0:db:f6:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Build\Source\NOSK\exe\noske64\release\noske64.pdb

Imports

kernel32

GetModuleHandleA
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetProcessHeap
HeapFree
GetModuleHandleW
lstrcmpiW
GetSystemInfo
HeapAlloc
GetVersionExA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
RtlVirtualUnwind
RtlLookupFunctionEntry
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
Sleep
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
HeapSize
RaiseException
RtlPcToFileHeader

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
npk/noskes.dll
.dll windows:4 windows x86 arch:x86

fd30f5a0daf8f1aaf0e47b1d71f772c7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d1:cd:b5:4b:cc:ca:cb:87:72:07:5c:a9:4d:1c:19:44:56:df:ef:a2:22:e6:a9:e2:f5:df:73:28:5a:ba:1e:79
Signer

Actual PE Digest

d1:cd:b5:4b:cc:ca:cb:87:72:07:5c:a9:4d:1c:19:44:56:df:ef:a2:22:e6:a9:e2:f5:df:73:28:5a:ba:1e:79

Digest Algorithm

sha256

PE Digest Matches

true

48:a8:9b:02:f5:82:72:0e:5d:7d:e4:c8:29:e0:fe:57:f6:c2:78:28
Signer

Actual PE Digest

48:a8:9b:02:f5:82:72:0e:5d:7d:e4:c8:29:e0:fe:57:f6:c2:78:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskes\release\noskes.pdb

Imports

kernel32

GetModuleHandleW
LeaveCriticalSection
GetProcAddress
CreateEventW
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
WaitForMultipleObjects
LocalAlloc
CreateFileW
ReadFile
GetCurrentProcess
LocalFree
SetEvent
GetLastError
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
Sleep
GetModuleFileNameW
CloseHandle
SetLastError
DeleteCriticalSection
CreateProcessW
WaitForSingleObject
DeviceIoControl
EnterCriticalSection
FlushFileBuffers
CreateFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

GetKeyboardLayout

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskes64.dll
.dll windows:4 windows x64 arch:x64

9ee45cead6d222ea4516075a4d6bfa50

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2b:7e:37:94:43:45:15:f4:4a:c6:9e:19:74:7a:dd:19:3d:e5:6b:96:4f:d7:26:a0:1f:6c:a0:e6:44:e1:16:97
Signer

Actual PE Digest

2b:7e:37:94:43:45:15:f4:4a:c6:9e:19:74:7a:dd:19:3d:e5:6b:96:4f:d7:26:a0:1f:6c:a0:e6:44:e1:16:97

Digest Algorithm

sha256

PE Digest Matches

true

32:be:8c:a1:0b:7a:4b:d1:f5:3e:61:f2:c7:8a:fa:f7:3e:27:f1:20
Signer

Actual PE Digest

32:be:8c:a1:0b:7a:4b:d1:f5:3e:61:f2:c7:8a:fa:f7:3e:27:f1:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskes\release\noskes64.pdb

Imports

kernel32

GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
CreateFileW
CreateEventW
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
GetLastError
Sleep
WaitForMultipleObjects
LocalAlloc
GetModuleFileNameW
ReadFile
LocalFree
SetEvent
CloseHandle
MultiByteToWideChar
DeleteCriticalSection
SetLastError
CreateProcessW
WaitForSingleObject
DeviceIoControl
FlushFileBuffers
CreateFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetModuleHandleA
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

GetKeyboardLayout

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskfx.dll
.dll windows:4 windows x86 arch:x86

79962220dca5f30a298ab30455572a15

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d0:62:9f:ee:34:92:27:7e:35:ab:27:18:96:34:22:58:1d:1a:42:2d:af:43:7a:cd:d0:e0:bf:d2:bb:2d:7c:9b
Signer

Actual PE Digest

d0:62:9f:ee:34:92:27:7e:35:ab:27:18:96:34:22:58:1d:1a:42:2d:af:43:7a:cd:d0:e0:bf:d2:bb:2d:7c:9b

Digest Algorithm

sha256

PE Digest Matches

true

fb:83:66:cb:49:4a:77:9c:46:32:e4:ff:c8:17:4f:f7:5d:8f:6a:cc
Signer

Actual PE Digest

fb:83:66:cb:49:4a:77:9c:46:32:e4:ff:c8:17:4f:f7:5d:8f:6a:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskfx\release\noskfx.pdb

Imports

kernel32

GetSystemInfo
SetLastError
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
CreateThread
GetExitCodeThread
TerminateThread
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryW
GetBinaryTypeW
LocalAlloc
OpenProcess
DuplicateHandle
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
DeviceIoControl
CreateFileW
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
Sleep
GetStringTypeA
GetVersionExW
InterlockedExchange
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
FatalAppExitA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
GetCurrentThread
InterlockedDecrement
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
Process32NextW
GetLastError
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
DeleteCriticalSection
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
LocalFree
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
ReleaseMutex
WaitForSingleObject
CreateMutexW
InitializeCriticalSection
GetTickCount
RaiseException
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetVersionExA
CreateEventW
GetModuleHandleA
GetStringTypeW
GetFileSize
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetSystemTime
QueryPerformanceCounter
LoadLibraryA
GlobalMemoryStatusEx
QueryPerformanceFrequency

user32

GetAsyncKeyState
PostMessageW
GetWindowThreadProcessId
GetSystemMetrics
FindWindowA
MapVirtualKeyW
GetKeyboardLayoutNameW
GetKeyboardLayout
SetPropW
GetWindowRect
ShowWindow
CreateDialogParamW
EndDialog
FindWindowW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
VkKeyScanW
SetWindowLongA
GetClassLongA
SetWindowLongW
GetClassLongW
IsWindowUnicode
GetGUIThreadInfo
KillTimer
SetTimer
RemovePropW
GetPropW
CharUpperW
GetWindowTextW
GetAncestor
UnregisterDeviceNotification
RegisterDeviceNotificationW
SystemParametersInfoW
CallWindowProcA
CallWindowProcW
SetFocus
AttachThreadInput
GetFocus
GetForegroundWindow
IsWindowEnabled
IsWindow
GetParent
GetClassNameW
SendMessageW
SendInput
GetKeyboardType
GetKeyState
keybd_event
SendMessageTimeoutW
CharLowerW
GetCursorPos

advapi32

QueryServiceConfigW
AdjustTokenPrivileges
RegOpenKeyExW
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegEnumKeyW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW

shell32

ord680

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW

imm32

ImmSetConversionStatus
ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetConversionStatus
ImmGetContext
ImmNotifyIME

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSFreeMemory

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

ole32

CoCreateGuid

Sections

.text
Size: 352KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskfx64.dll
.dll windows:4 windows x64 arch:x64

9067c44528b02cd63c1c85386c05be6a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b5:ae:a9:aa:a1:bf:85:53:cd:0d:35:cb:3d:e2:95:34:47:9d:53:94:42:ed:05:9f:b9:5f:a8:3f:60:4f:b1:fc
Signer

Actual PE Digest

b5:ae:a9:aa:a1:bf:85:53:cd:0d:35:cb:3d:e2:95:34:47:9d:53:94:42:ed:05:9f:b9:5f:a8:3f:60:4f:b1:fc

Digest Algorithm

sha256

PE Digest Matches

true

1d:8a:3d:55:08:c4:4f:c2:9f:e0:6d:79:39:ad:5d:18:e8:26:36:c4
Signer

Actual PE Digest

1d:8a:3d:55:08:c4:4f:c2:9f:e0:6d:79:39:ad:5d:18:e8:26:36:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskfx\release\noskfx64.pdb

Imports

kernel32

SetLastError
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
CreateThread
GetExitCodeThread
TerminateThread
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryW
GetBinaryTypeW
LocalAlloc
GetCurrentProcess
VirtualFree
OpenProcess
DuplicateHandle
VirtualAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
lstrcmpiW
CreateFileW
DeviceIoControl
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
GetDateFormatA
Sleep
GetStringTypeA
LocalFree
HeapReAlloc
FatalAppExitA
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringW
LCMapStringA
HeapDestroy
HeapCreate
HeapSetInformation
GetModuleFileNameA
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
RtlVirtualUnwind
FlsAlloc
GetCurrentThread
TlsSetValue
FlsFree
TlsFree
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
Process32NextW
GetModuleFileNameW
Process32FirstW
CreateToolhelp32Snapshot
GetLastError
CloseHandle
DeleteCriticalSection
CreateEventW
FlsGetValue
DebugBreak
GetStdHandle
GetFileType
WriteConsoleW
RtlUnwindEx
GetSystemInfo
GetVersionExW
ReleaseMutex
WaitForSingleObject
CreateMutexW
SetEvent
InitializeCriticalSection
GetTickCount
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
GetCommandLineA
FlsSetValue
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetStringTypeW
CreateFileMappingA
GetFileSize
MapViewOfFile
UnmapViewOfFile
LoadLibraryA
GetSystemTime
QueryPerformanceCounter
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetVersionExA
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess

user32

GetAsyncKeyState
GetClassNameW
GetSystemMetrics
GetKeyboardLayoutNameW
FindWindowA
MapVirtualKeyW
GetWindowThreadProcessId
GetKeyboardLayout
SetPropW
GetWindowRect
ShowWindow
CreateDialogParamW
EndDialog
FindWindowW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
VkKeyScanW
SetWindowLongPtrA
GetClassLongPtrA
SetWindowLongPtrW
GetClassLongPtrW
IsWindowUnicode
GetGUIThreadInfo
KillTimer
SetTimer
RemovePropW
GetPropW
GetParent
UnregisterDeviceNotification
GetWindowTextW
RegisterDeviceNotificationW
GetAncestor
SystemParametersInfoW
CallWindowProcA
CallWindowProcW
GetFocus
GetForegroundWindow
SetFocus
AttachThreadInput
SendMessageW
SendInput
GetKeyState
SendMessageTimeoutW
CharLowerW
CharUpperW
PostMessageW
GetKeyboardType
keybd_event
IsWindowEnabled
IsWindow
GetCursorPos

advapi32

CloseServiceHandle
AdjustTokenPrivileges
RegOpenKeyExW
OpenProcessToken
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegEnumKeyW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW

shell32

ord680

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW

imm32

ImmSetConversionStatus
ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetConversionStatus
ImmGetContext
ImmNotifyIME

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSFreeMemory

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

ole32

CoCreateGuid

Sections

.text
Size: 566KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskm.dll
.dll windows:4 windows x86 arch:x86

bdf8e8bf13550296d1d3b847d2c2e570

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8c:df:e5:20:1a:61:5c:90:2c:2b:9a:9c:27:4c:9b:3b:c5:a1:78:53:8b:5c:a1:31:75:de:12:ae:07:82:41:f9
Signer

Actual PE Digest

8c:df:e5:20:1a:61:5c:90:2c:2b:9a:9c:27:4c:9b:3b:c5:a1:78:53:8b:5c:a1:31:75:de:12:ae:07:82:41:f9

Digest Algorithm

sha256

PE Digest Matches

true

d4:66:63:06:29:d1:b9:9b:8c:ca:d3:19:46:a9:38:84:99:ee:18:ab
Signer

Actual PE Digest

d4:66:63:06:29:d1:b9:9b:8c:ca:d3:19:46:a9:38:84:99:ee:18:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskm\release\noskm.pdb

Imports

imm32

ImmReleaseContext
ImmGetDefaultIMEWnd
ImmNotifyIME
ImmGetContext

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

kernel32

ExitProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
WaitForSingleObject
CreateEventW
CloseHandle
GetModuleFileNameW
GetLastError
SetEvent
GetCurrentThreadId
Sleep
CreateThread
GetExitCodeThread
TerminateThread
ResetEvent
GetSystemDirectoryW
SetLastError
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
lstrlenW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateFileW
CreateFileMappingW
GetFileSize
MapViewOfFile
UnmapViewOfFile
InterlockedExchange
GetACP
WriteFile
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
VirtualAlloc
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetStdHandle
GetModuleFileNameA
GetLocaleInfoA
IsValidCodePage
GetOEMCP
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentProcessId
GetSystemTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo

user32

DefWindowProcW
PostQuitMessage
GetCursorPos
GetSystemMetrics
UnregisterClassA
MessageBoxW
keybd_event
SystemParametersInfoW
GetForegroundWindow
FindWindowExW
IsWindowEnabled
GetClassNameW
FindWindowW
EnumChildWindows
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassW

ole32

CoCreateGuid

oleaut32

VariantClear
SysStringLen
SysAllocString
VarBstrCat
SysStringByteLen
SysFreeString
SysAllocStringLen
SysAllocStringByteLen

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW

crypt32

CertFreeCertificateContext

wintrust

WinVerifyTrust

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npk/noskne.dll
.dll windows:4 windows x86 arch:x86

2c3b5dfddf482859ff80e2482f5966a3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

50:b2:2e:a1:2b:df:d2:31:35:00:15:0d:c1:4f:57:12:ec:73:68:62:3e:7b:ef:66:a6:7d:62:e2:20:b6:c2:5e
Signer

Actual PE Digest

50:b2:2e:a1:2b:df:d2:31:35:00:15:0d:c1:4f:57:12:ec:73:68:62:3e:7b:ef:66:a6:7d:62:e2:20:b6:c2:5e

Digest Algorithm

sha256

PE Digest Matches

true

db:f8:26:d2:98:2c:91:8e:2f:e5:05:f0:3d:19:c4:41:fd:83:4a:5b
Signer

Actual PE Digest

db:f8:26:d2:98:2c:91:8e:2f:e5:05:f0:3d:19:c4:41:fd:83:4a:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskne\release\noskne.pdb

Imports

kernel32

FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
OpenProcess
CloseHandle
MultiByteToWideChar
GetModuleHandleW
CreateFileW
ReadFile
DeviceIoControl
TerminateThread
CreateEventW
GetExitCodeThread
WaitForSingleObject
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetWindowsDirectoryW
CompareStringW
CompareStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

shlwapi

PathFindFileNameW

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskne64.dll
.dll windows:4 windows x64 arch:x64

1094f8d8f4ced5bbf565a396b75c277f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f6:25:50:17:b4:0f:ad:a7:1a:4f:65:f1:af:85:5a:e5:11:e4:66:82:60:6a:66:df:d2:27:19:cc:7d:f7:8f:7e
Signer

Actual PE Digest

f6:25:50:17:b4:0f:ad:a7:1a:4f:65:f1:af:85:5a:e5:11:e4:66:82:60:6a:66:df:d2:27:19:cc:7d:f7:8f:7e

Digest Algorithm

sha256

PE Digest Matches

true

c2:14:ac:10:67:28:c1:ff:b1:15:4e:75:28:b2:a4:cd:ca:b7:ae:2e
Signer

Actual PE Digest

c2:14:ac:10:67:28:c1:ff:b1:15:4e:75:28:b2:a4:cd:ca:b7:ae:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskne\release\noskne64.pdb

Imports

kernel32

FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
OpenProcess
CloseHandle
GetModuleHandleW
CreateFileW
ReadFile
MultiByteToWideChar
DeviceIoControl
TerminateThread
CreateEventW
GetExitCodeThread
WaitForSingleObject
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetWindowsDirectoryW
CompareStringW
CompareStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetModuleHandleA
FlsGetValue
TlsAlloc
TlsFree
FlsFree
SetLastError
TlsSetValue
GetCurrentThread
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

shlwapi

PathFindFileNameW

Sections

.text
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskp.sys
.sys windows:6 windows x86 arch:x86

0b660f5cc3f1ba0a0f57e8cc78e08b99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\i386\noskp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
memcpy
rand
srand
KeInsertQueue
IofCompleteRequest
KeRemoveQueue
KeReadStateQueue
KeReleaseMutex
KeWaitForSingleObject
KeSetEvent
KeInitializeQueue
KeRundownQueue
KeBugCheck
ObReferenceObjectByHandle
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExDeleteNPagedLookasideList
ZwClose
PsCreateSystemThread
KeInitializeMutex
ExInitializeNPagedLookasideList
ExFreePoolWithTag
IoCreateSymbolicLink
IoCreateDevice
KeInsertQueueDpc
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoDriverObjectType
ObReferenceObjectByName
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
ExAllocatePool
KeDelayExecutionThread
KeTickCount
KeBugCheckEx
memset
PsGetVersion
ExInterlockedPushEntrySList
KeInitializeDpc
ExInterlockedPopEntrySList
MmGetSystemRoutineAddress

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
HalGetInterruptVector

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskp64.sys
.sys windows:6 windows x64 arch:x64

9c88f4e55aeb3f2903de2a5331ce4896

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\amd64\noskp64.pdb

Imports

ntoskrnl.exe

KeRemoveQueue
IoDeleteSymbolicLink
ExFreePoolWithTag
KeInitializeMutex
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeDpc
ExpInterlockedPopEntrySList
KeReleaseMutex
PsCreateSystemThread
rand
ExEventObjectType
ZwClose
srand
KeBugCheck
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
KeInitializeQueue
PsGetVersion
IoCreateSymbolicLink
ExAllocatePoolWithTag
ExDeleteNPagedLookasideList
KeInsertQueue
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeReleaseSpinLock
IoDriverObjectType
IoGetDeviceObjectPointer
KeInsertQueueDpc
ObfDereferenceObject
ObReferenceObjectByName
IofCallDriver
KeAcquireSpinLockRaiseToDpc
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
RtlFreeUnicodeString
ZwUnmapViewOfSection
ExAllocatePool
ZwCreateSection
ZwOpenFile
KeBugCheckEx
IoCreateDevice
KeReadStateQueue
MmGetSystemRoutineAddress

hal

KeQueryPerformanceCounter

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskre.dll
.dll windows:4 windows x86 arch:x86

a773eb457b984598fca17e185657df43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:74:ca:1e:e7:55:17:91:6f:c5:63:5f:4f:d1:f4:c7:5c:ff:d0:e7:e9:a1:2c:04:06:ef:69:06:94:1f:29:b9
Signer

Actual PE Digest

97:74:ca:1e:e7:55:17:91:6f:c5:63:5f:4f:d1:f4:c7:5c:ff:d0:e7:e9:a1:2c:04:06:ef:69:06:94:1f:29:b9

Digest Algorithm

sha256

PE Digest Matches

true

fc:23:92:88:07:1a:45:5f:06:cb:84:a2:07:11:f5:a3:34:ae:43:37
Signer

Actual PE Digest

fc:23:92:88:07:1a:45:5f:06:cb:84:a2:07:11:f5:a3:34:ae:43:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskre\release\noskre.pdb

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
GetModuleFileNameW
CreateFileW
CreateFileMappingA
CloseHandle
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetProcessHeap
GetProcAddress
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
GetCurrentProcessId
GetSystemTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetLastError
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA

advapi32

CryptGenRandom
CryptAcquireContextW
CryptReleaseContext

user32

GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

Sections

.text
Size: 220KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskre64.dll
.dll windows:4 windows x64 arch:x64

1c118dbf344c75032b4de41243ea9ceb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

da:37:0e:0c:bd:24:06:79:56:1c:29:9e:eb:52:e5:37:1b:20:ef:0e:ac:22:bc:17:31:21:c5:85:de:2c:47:2e
Signer

Actual PE Digest

da:37:0e:0c:bd:24:06:79:56:1c:29:9e:eb:52:e5:37:1b:20:ef:0e:ac:22:bc:17:31:21:c5:85:de:2c:47:2e

Digest Algorithm

sha256

PE Digest Matches

true

98:d1:a0:85:08:f5:55:60:1e:5e:4f:4b:ab:7a:9e:71:55:7b:15:6e
Signer

Actual PE Digest

98:d1:a0:85:08:f5:55:60:1e:5e:4f:4b:ab:7a:9e:71:55:7b:15:6e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskre\release\noskre64.pdb

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
CreateFileMappingA
GetFileSize
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
GetProcAddress
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
GetCurrentProcessId
GetSystemTime
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetSystemTimeAsFileTime
FlsSetValue
GetCommandLineA
HeapFree
HeapAlloc
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
RtlVirtualUnwind
GetModuleHandleA
FlsGetValue
TlsAlloc
TlsFree
FlsFree
SetLastError
TlsSetValue
GetCurrentThread
FlsAlloc
Sleep
HeapSize
ExitProcess
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteFile
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
SetConsoleCtrlHandler
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA

advapi32

CryptGenRandom
CryptAcquireContextW
CryptReleaseContext

user32

GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

Sections

.text
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosksdk.dll
.dll windows:4 windows x86 arch:x86

cd5680f53d819127124ea7d4fe61409f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:27:d4:eb:88:dd:d0:b9:4a:9e:97:50:d9:16:fe:12:3a:aa:6c:d2:1d:ce:7b:44:af:f5:ba:80:1c:27:31:a7
Signer

Actual PE Digest

84:27:d4:eb:88:dd:d0:b9:4a:9e:97:50:d9:16:fe:12:3a:aa:6c:d2:1d:ce:7b:44:af:f5:ba:80:1c:27:31:a7

Digest Algorithm

sha256

PE Digest Matches

true

00:21:6a:27:9a:c3:cb:f4:2c:e7:34:7f:cc:ab:14:0a:ca:4c:a6:1f
Signer

Actual PE Digest

00:21:6a:27:9a:c3:cb:f4:2c:e7:34:7f:cc:ab:14:0a:ca:4c:a6:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\nosksdk\release\nosksdk.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

OpenMutexW
CloseHandle
GetModuleFileNameW
GetModuleHandleW
CreateEventW
DeleteCriticalSection
GetLastError
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
SetEvent
WideCharToMultiByte
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
SetLastError
CreateThread
GetExitCodeThread
MultiByteToWideChar
CreateFileA
GetLocaleInfoW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
WaitForSingleObject
CompareStringA
CompareStringW
TerminateThread
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
SetEnvironmentVariableA
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
LCMapStringW
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
LoadIconW
DefWindowProcW
PostQuitMessage
SetForegroundWindow
ShowWindow
CreateDialogParamW
EndDialog
MessageBoxA
GetDlgItem
SetWindowPos
GetClientRect
GetSystemMetrics
MessageBoxW
GetWindowTextW
GetWindowTextA
IsWindowUnicode
IsWindow

advapi32

RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW

Exports

Exports

B13C41F679D245f8A77B299638DA23F4
BD862FD6AED744cd8E9494496F411E77
C3FB1476469C441aAE627C211143EB36
C5DF95B4C2AB4e6bA256752CA1226453
C66BFC39B60740bd97E0BA329879410C
C8C8FF8E24C4491d93770B7AA2DBEA0D
CA5F752F960443ebB1F37CA9C6CB1B43
CA7D6C5180D24fb99441831B0ADEB225
CF7FEF77B7304d9dBE045AD6678BEBB7
D49C95B941BA47cf8070310C5B9F2CA8
D566D5CB1C2142b8BB77452E96483857
DE02AC21F7304d0e859BD8E23DDD3F20
E1CF819097CD4f2b9E51A5816369B34D
E2231243DEEF47a891BFE54F0A2FFC76
F0111B7F4EA04cf5B37069F2739D421B
F40F83011F9D49028732A46B66F78824
F523B3FC057442afB518F17709EE7E97
F797FD3654C64aedBFB54A900ABF4838
F9B781E5E0874a7bB7E64C49F69A85A5
FC1964279D65464eBF3269D01AF4E6D5
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NPKGetWindowText@12
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptEnd@8
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptInit@12
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkRegCryptWindow@12
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkSetOpt@8

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosksdk64.dll
.dll windows:4 windows x64 arch:x64

a4021df40f58f29d5d9b5ed5a0b3e5b2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:fa:b4:2b:ac:64:81:8f:6c:45:75:ce:a0:d7:b7:d4:a4:90:66:55:e6:ce:de:df:c0:25:b2:7d:02:cd:44:0a
Signer

Actual PE Digest

0d:fa:b4:2b:ac:64:81:8f:6c:45:75:ce:a0:d7:b7:d4:a4:90:66:55:e6:ce:de:df:c0:25:b2:7d:02:cd:44:0a

Digest Algorithm

sha256

PE Digest Matches

true

c5:4a:b8:fe:4a:d4:96:3e:fa:a5:db:62:e3:95:c5:5b:ea:71:41:10
Signer

Actual PE Digest

c5:4a:b8:fe:4a:d4:96:3e:fa:a5:db:62:e3:95:c5:5b:ea:71:41:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\nosksdk\release\nosksdk64.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
CreateEventW
DeleteCriticalSection
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
SetEvent
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
SetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
TerminateThread
OpenMutexW
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
GetDateFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapReAlloc
InitializeCriticalSection
LoadLibraryA
SetConsoleCtrlHandler
GetConsoleMode
MultiByteToWideChar
CompareStringA
CompareStringW
WideCharToMultiByte
RaiseException
GetConsoleCP
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
SetEnvironmentVariableA
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
HeapDestroy
FlsGetValue
TlsAlloc
TlsFree
FlsFree
TlsSetValue
GetCurrentThread
FlsAlloc
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA

user32

GetWindowTextW
IsWindowUnicode
IsWindow
CreateWindowExW
RegisterClassExW
LoadIconW
DefWindowProcW
PostQuitMessage
SetForegroundWindow
ShowWindow
CreateDialogParamW
EndDialog
MessageBoxA
MessageBoxW
GetDlgItem
GetWindowTextA
SetWindowPos
GetClientRect
GetSystemMetrics
DispatchMessageW
TranslateMessage
GetMessageW

advapi32

RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW

Exports

Exports

B13C41F679D245f8A77B299638DA23F4
BD862FD6AED744cd8E9494496F411E77
C3FB1476469C441aAE627C211143EB36
C5DF95B4C2AB4e6bA256752CA1226453
C66BFC39B60740bd97E0BA329879410C
C8C8FF8E24C4491d93770B7AA2DBEA0D
CA5F752F960443ebB1F37CA9C6CB1B43
CA7D6C5180D24fb99441831B0ADEB225
CF7FEF77B7304d9dBE045AD6678BEBB7
D49C95B941BA47cf8070310C5B9F2CA8
D566D5CB1C2142b8BB77452E96483857
DE02AC21F7304d0e859BD8E23DDD3F20
E1CF819097CD4f2b9E51A5816369B34D
E2231243DEEF47a891BFE54F0A2FFC76
F0111B7F4EA04cf5B37069F2739D421B
F40F83011F9D49028732A46B66F78824
F523B3FC057442afB518F17709EE7E97
F797FD3654C64aedBFB54A900ABF4838
F9B781E5E0874a7bB7E64C49F69A85A5
FC1964279D65464eBF3269D01AF4E6D5
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NPKGetWindowText
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptEnd
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptInit
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkRegCryptWindow
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkSetOpt

Sections

.text
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosku.sys
.sys windows:6 windows x86 arch:x86

618f0d2cb74a4fd908dc9c421a239144

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\i386\nosku.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
IoReleaseRemoveLockEx
IofCallDriver
IoAcquireRemoveLockEx
KeRemoveQueue
KeReadStateQueue
KeSetEvent
KeInitializeQueue
KeRundownQueue
ObReferenceObjectByHandle
ExEventObjectType
DbgPrint
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExAllocatePool
RtlCompareMemory
memcpy
IoDetachDevice
KeInsertQueue
PoStartNextPowerIrp
IoInitializeRemoveLockEx
IoAttachDeviceToDeviceStack
PsGetVersion
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExfInterlockedInsertHeadList
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwQuerySystemInformation
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
_vsnprintf
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByName
IoDriverObjectType
MmIsAddressValid
KeTickCount
KeBugCheckEx
srand
rand
ExAllocatePoolWithTag
ExFreePoolWithTag
memset
ExInterlockedPushEntrySList
PoCallDriver
ExInterlockedPopEntrySList
RtlUnwind

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter

usbd.sys

_USBD_ParseConfigurationDescriptorEx@28

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosku64.sys
.sys windows:6 windows x64 arch:x64

8550e6c402121795663b7087da3991d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\amd64\nosku64.pdb

Imports

ntoskrnl.exe

IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
ExpInterlockedPopEntrySList
IoDetachDevice
ExAllocatePool
rand
ExEventObjectType
PoStartNextPowerIrp
srand
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
KeInitializeQueue
PoCallDriver
PsGetVersion
KeRemoveQueue
IoCreateSymbolicLink
IoInitializeRemoveLockEx
IoCreateDevice
DbgPrint
ExDeleteNPagedLookasideList
IofCallDriver
KeInsertQueue
KeAcquireSpinLockRaiseToDpc
ExInterlockedInsertHeadList
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
RtlFreeUnicodeString
ZwUnmapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlUnicodeStringToAnsiString
IoDriverObjectType
_vsnprintf
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
KeBugCheckEx
IoAcquireRemoveLockEx
ExAllocatePoolWithTag
RtlCompareMemory
KeReadStateQueue
_local_unwind
RtlUnwindEx

hal

KeQueryPerformanceCounter

usbd.sys

USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/np_ck32s.sys
.sys windows:6 windows x86 arch:x86

2429bd661b999e0ddeaef9e42eff057e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:10:be:cc:d3:d7:61:1f:be:cc:3d:e4:4d:4b:b7:64:0d:6d:4a:31
Signer

Actual PE Digest

53:10:be:cc:d3:d7:61:1f:be:cc:3d:e4:4d:4b:b7:64:0d:6d:4a:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\_crypto\npcrypto_src\npcrypto\np_ck32s\objfre_w2k_x86\i386\np_ck32s.pdb

Imports

ntoskrnl.exe

memset
ZwQuerySystemInformation
ZwClose
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsTerminateSystemThread
KeDelayExecutionThread
KdDebuggerEnabled
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
PsCreateSystemThread
ExAllocatePoolWithTag
DbgPrint
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
memcpy
KeQuerySystemTime
PsGetCurrentThreadId
PsGetCurrentProcessId
KeTickCount
KeBugCheckEx
MmIsAddressValid
ExFreePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

_NpDecPK@32
_NpDecSymk@28
_NpDestroy@4
_NpEncPK@32
_NpEncSymk@28
_NpGetState@8
_NpHMAC@32
_NpHash@24
_NpInit@4
_NpPKGen@16
_NpRandom@12
_NpSKGen@12
_NpSelfTest@4
_NpSignPK@24
_NpVerifyPK@24

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 393B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 896B - Virtual size: 802B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 768B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/np_ck64s.sys
.sys windows:6 windows x64 arch:x64

a91fd37ae6dce75fc02368dc80bb0bcb

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-12-2011 00:00

Not After

06-12-2012 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:9a:26:bf:b8:00:e9:9f:c6:ca:00:4e:42:f1:a9:0b:f5:b1:22:98
Signer

Actual PE Digest

17:9a:26:bf:b8:00:e9:9f:c6:ca:00:4e:42:f1:a9:0b:f5:b1:22:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\_crypto\npcrypto_src\npcrypto\np_ck64s\objfre_wnet_amd64\amd64\np_ck64s.pdb

Imports

ntoskrnl.exe

RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
PsCreateSystemThread
KdDebuggerEnabled
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExFreePoolWithTag
ObfDereferenceObject
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
DbgPrint
PsGetCurrentThreadId
PsGetCurrentProcessId
KeBugCheckEx
MmIsAddressValid
ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

NpDecPK
NpDecSymk
NpDestroy
NpEncPK
NpEncSymk
NpGetState
NpHMAC
NpHash
NpInit
NpPKGen
NpRandom
NpSKGen
NpSelfTest
NpSignPK
NpVerifyPK

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/npcf_win_32u.dll
.dll windows:4 windows x86 arch:x86

e173053aab7169b17490d0773c9dff4a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\docs\암호모듈검증_프로젝트\제출물\nprotect_crypto_v1.1_2014.07.14\source\winodws\dll\release\npcf_win_32u.pdb

Imports

kernel32

GetTickCount
GetProcessHeap
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryW
QueryPerformanceFrequency
GetCurrentThreadId
CloseHandle
GetVersionExW
GetCurrentProcessId
GetSystemTime
FreeLibrary
QueryPerformanceCounter
GetProcAddress
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingW
GetFileSize
DuplicateHandle
GetCurrentProcess
OpenProcess
Sleep
CreateThread
TerminateThread
LCMapStringW
LCMapStringA
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA

user32

FindWindowW
GetSystemMetrics
GetCursorPos

ole32

CoCreateGuid

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/npkakl.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10-11-2014 00:00

Not After

10-11-2015 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f
Signer

Actual PE Digest

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkeycrypt\drivers\5.0\nt\npkakl\npkakl\objfre\i386\npkakl.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/npkfxa.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10-11-2014 00:00

Not After

10-11-2015 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a
Signer

Actual PE Digest

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkfx65\sys\npkfxa\npkakl\npkfxa\objfre\i386\npkfxa.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nppb.dll
.dll windows:4 windows x86 arch:x86

00db911b28a8cd6b64fe48e8520f85bb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24-06-2015 00:00

Not After

30-06-2016 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f
Signer

Actual PE Digest

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f

Digest Algorithm

sha256

PE Digest Matches

true

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc
Signer

Actual PE Digest

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nppb\release\nppb.pdb

Imports

kernel32

GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
WriteFile
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nprotect_install.exe
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ef:78:23:da:cf:d3:72:de:b0:cf:ee:96:f7:46:ad:0e:6c:50:70:ec:80:c0:6d:8d:da:7e:55:c3:2d:d7:6b:19
Signer

Actual PE Digest

ef:78:23:da:cf:d3:72:de:b0:cf:ee:96:f7:46:ad:0e:6c:50:70:ec:80:c0:6d:8d:da:7e:55:c3:2d:d7:6b:19

Digest Algorithm

sha256

PE Digest Matches

true

d2:38:6b:eb:fd:e9:da:03:c5:94:e4:25:3e:3e:8c:63:ca:78:cf:c7
Signer

Actual PE Digest

d2:38:6b:eb:fd:e9:da:03:c5:94:e4:25:3e:3e:8c:63:ca:78:cf:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 884KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nos_launcher.exe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07-11-2016 00:00

Not After

07-11-2017 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:9e:d0:c4:a9:88:85:62:7e:f8:08:ff:8c:34:14:22:b6:5b:2b:7f:dd:60:cf:a5:25:ff:aa:d7:6c:ea:82:cb
Signer

Actual PE Digest

1c:9e:d0:c4:a9:88:85:62:7e:f8:08:ff:8c:34:14:22:b6:5b:2b:7f:dd:60:cf:a5:25:ff:aa:d7:6c:ea:82:cb

Digest Algorithm

sha256

PE Digest Matches

true

8a:6b:38:e1:eb:99:ce:89:fe:21:b0:67:b8:70:df:fd:83:ec:dc:23
Signer

Actual PE Digest

8a:6b:38:e1:eb:99:ce:89:fe:21:b0:67:b8:70:df:fd:83:ec:dc:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wdnyxedj
Size: 924KB - Virtual size: 924KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

qsgkyqdu
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nps/bar_bg.npi
nps/bar_full.npi
.gif
nps/bgBottom.npi
.png
nps/bi.npi
.jpg
nps/close.npi
nps/imgWarn.npi
.jpg
nps/logo.npi
nps/nphapsie_eng.nph
nps/nphapsie_kor.nph
nps/npicommon.npi
.png
nps/npimain_conf.npi
.png
nps/npimsg1.npi
.png
nps/npimsg2.npi
.png
nps/npimsg3.npi
.png
nps/npimsg5.npi
.png
nps/npimsg6.npi
.png
nps/npimsg7.npi
.png
nps/npinpnmini.npi
.png
nps/npiui.npi
.png
npslm20.npd
.dll windows:4 windows x86 arch:x86

5968ee0bfa638ed531c98b20e5fa170d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-11-2017 00:00

Not After

05-11-2018 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:c0:a1:33:90:19:cd:ad:26:6e:4f:e7:1d:47:45:f6:34:5d:32:76:2a:f0:60:bf:b6:68:1f:86:95:14:64:5c
Signer

Actual PE Digest

20:c0:a1:33:90:19:cd:ad:26:6e:4f:e7:1d:47:45:f6:34:5d:32:76:2a:f0:60:bf:b6:68:1f:86:95:14:64:5c

Digest Algorithm

sha256

PE Digest Matches

true

14:80:39:23:0b:f1:c7:23:49:b7:44:21:7a:9f:70:da:f4:42:86:ec
Signer

Actual PE Digest

14:80:39:23:0b:f1:c7:23:49:b7:44:21:7a:9f:70:da:f4:42:86:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npslm20\build\bin\release\npslm20.pdb

Imports

kernel32

GetWindowsDirectoryW
GetLogicalDrives
QueryDosDeviceW
LoadLibraryW
GetSystemDirectoryW
ReleaseMutex
CreateMutexW
CreateFileA
CreateProcessW
SetFilePointer
WriteFile
lstrlenW
GetFileTime
SetFileTime
SystemTimeToFileTime
GetSystemTime
DeleteFileW
SetFileAttributesW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetStringTypeExW
CreateThread
WaitForSingleObject
TerminateThread
GetLogicalDriveStringsW
GetDriveTypeW
FindFirstFileW
FileTimeToSystemTime
FindNextFileW
FindClose
GetDateFormatW
CreateFileW
DeviceIoControl
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
lstrcmpiW
WideCharToMultiByte
MultiByteToWideChar
ProcessIdToSessionId
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Sleep
Process32NextW
GetModuleHandleA
GetModuleFileNameW
GetCurrentProcess
CreateDirectoryW
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
GetVolumeInformationW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
RaiseException
RtlUnwind
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
TerminateProcess
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetProcessHeap
GetModuleHandleW
GetProcAddress
HeapFree
CloseHandle
OpenProcess
LocalFree
GetLastError
LocalAlloc
SetLastError
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
GetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
OutputDebugStringW
InterlockedDecrement
GetVersion
HeapAlloc
GetFileSize
ReadFile
GetStringTypeW
GetStringTypeA
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
GetVersionExA
GetCommandLineA
GetCurrentThreadId
GetFileAttributesW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

LoadStringW
CharUpperW
GetSystemMetrics

advapi32

CryptCreateHash
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
OpenProcessToken
LookupAccountSidW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
RegCloseKey
RegQueryValueExW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptDeriveKey
CryptAcquireContextW
GetTokenInformation
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegOpenKeyW
RegEnumKeyExW
RegOpenKeyExW

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoTaskMemFree
CoCreateGuid
CoInitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

VariantClear
VariantCopy
VariantInit
SysFreeString
SysAllocString
VariantChangeType

shlwapi

StrDupW
PathFileExistsW
StrStrW
PathIsDirectoryW
PathAppendW
PathRemoveFileSpecW
PathRemoveBackslashW

wininet

InternetCloseHandle
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
InternetSetOptionW
HttpOpenRequestW
InternetConnectW
InternetOpenW

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertNameToStrW

ws2_32

WSAGetLastError
gethostbyname
inet_ntoa
getservbyname
htons
gethostbyaddr
getservbyport
inet_addr
WSACleanup
WSAStartup
WSASetLastError
ntohs
htonl

iphlpapi

GetAdaptersInfo
SendARP
GetIpAddrTable
GetIpForwardTable
GetBestRoute
GetAdaptersAddresses

psapi

GetModuleFileNameExW
GetModuleBaseNameW

rpcrt4

RpcStringFreeW
UuidToStringW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
CM_Get_Parent
CM_Get_Device_IDW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

dnsapi

DnsQuery_W
DnsFree

Exports

Exports

fn_getVersion

Sections

.text
Size: 472KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npx/nosinfo.npx
npx/npcIdsrule.npx
npx/npcaddon.npx
npx/npcbscallow.npx
npx/npcbscmsgbox.npx
npx/npccheckdom.npx
npx/npcfdsdom.npx
npx/npcfsavantirootkitlist.npx
npx/npcfsavmsgbox.npx
npx/npcfwallow.npx
npx/npcfwmsgbox.npx
npx/npcfwother.npx
npx/npchfm.npx
npx/npchtsgarak_wooribank.npx
npx/npcnpkdom.npx
npx/npcnpnbank_KFCC.npx
npx/npcnpnbank_bankcomm.npx
npx/npcnpnbank_bnk.npx
npx/npcnpnbank_charm.npx
npx/npcnpnbank_cu.npx
npx/npcnpnbank_cufilesystem.npx
npx/npcnpnbank_dmd.npx
npx/npcnpnbank_fsb.npx
npx/npcnpnbank_hanasavings.npx
npx/npcnpnbank_ibk.npx
npx/npcnpnbank_ibkinternet.npx
npx/npcnpnbank_jbbank.npx
npx/npcnpnbank_kbsavings.npx
npx/npcnpnbank_kebbank.npx
npx/npcnpnbank_kfb.npx
npx/npcnpnbank_knbank.npx
npx/npcnpnbank_moaloan.npx
npx/npcnpnbank_moastockloan.npx
npx/npcnpnbank_osb.npx
npx/npcnpnbank_peper.npx
npx/npcnpnbank_wooribank.npx
npx/npcnpncard_bccardhome.npx
npx/npcnpncard_bluewalnut.npx
npx/npcnpncard_hyundaicard.npx
npx/npcnpncard_hyundaicardhome.npx
npx/npcnpncard_lottecard.npx
npx/npcnpncard_nhcard.npx
npx/npcnpncard_samsungcard.npx
npx/npcnpncard_samsungcardhome.npx
npx/npcnpncard_shinhancard.npx
npx/npcnpncard_shinhancardhome.npx
npx/npcnpncommon_preview.npx
npx/npcnpncompany_KRP.npx
npx/npcnpncompany_benzfinancial.npx
npx/npcnpncompany_bestlg.npx
npx/npcnpncompany_bithumb.npx
npx/npcnpncompany_deliveryCar.npx
npx/npcnpncompany_hanacapital.npx
npx/npcnpncompany_hyundaicapital.npx
npx/npcnpncompany_hyundaicapital_AP.npx
npx/npcnpncompany_hyundaicapitalautodigital.npx
npx/npcnpncompany_hyundaicommercial.npx
npx/npcnpncompany_konai.npx
npx/npcnpncompany_lensa.npx
npx/npcnpncompany_lpoint.npx
npx/npcnpncompany_nhcapital.npx
npx/npcnpncompany_nowrms.npx
npx/npcnpncompany_shinmyung.npx
npx/npcnpncompany_ticketmonster.npx
npx/npcnpncompany_vwfs.npx
npx/npcnpncompany_withcapital.npx
npx/npcnpncompany_xlgames.npx
npx/npcnpndom.npx
npx/npcnpngarak_wooribank.npx
npx/npcnpngov_anyang.npx
npx/npcnpngov_barotalk.npx
npx/npcnpngov_childcare.npx
npx/npcnpngov_credit4u.npx
npx/npcnpngov_customs.npx
npx/npcnpngov_cwcl.npx
npx/npcnpngov_cyberpolice.npx
npx/npcnpngov_cyberseoulshinbo.npx
npx/npcnpngov_d2b.npx
npx/npcnpngov_diais.npx
npx/npcnpngov_dynamicebusan.npx
npx/npcnpngov_eminwon.goyang.npx
npx/npcnpngov_eminwonmolit.npx
npx/npcnpngov_emmskogas.npx
npx/npcnpngov_epost.npx
npx/npcnpngov_epostbank.npx
npx/npcnpngov_epostmall.npx
npx/npcnpngov_excard.npx
npx/npcnpngov_forest.npx
npx/npcnpngov_fss.npx
npx/npcnpngov_fuel.npx
npx/npcnpngov_gimpo.npx
npx/npcnpngov_gsnd.npx
npx/npcnpngov_guri.npx
npx/npcnpngov_happylife.npx
npx/npcnpngov_hf.npx
npx/npcnpngov_hipassdongtan.npx
npx/npcnpngov_icheon.npx
npx/npcnpngov_icl.npx
npx/npcnpngov_iros.npx
npx/npcnpngov_issi.npx
npx/npcnpngov_jindo.npx
npx/npcnpngov_kdic.npx
npx/npcnpngov_keris.npx
npx/npcnpngov_keris_childneis.npx
npx/npcnpngov_kipo.npx
npx/npcnpngov_kodit.npx
npx/npcnpngov_learninganyang.npx
npx/npcnpngov_mailknoc.npx
npx/npcnpngov_mailkogas.npx
npx/npcnpngov_mhisseoul.npx
npx/npcnpngov_nationsubsidy.npx
npx/npcnpngov_neis_keris.npx
npx/npcnpngov_nonghyup_hers.npx
npx/npcnpngov_nskkhealth.npx
npx/npcnpngov_nyjdreamcall.npx
npx/npcnpngov_oc.npx
npx/npcnpngov_police.npx
npx/npcnpngov_policemail.npx
npx/npcnpngov_postfc.npx
npx/npcnpngov_reunionunikorea.npx
npx/npcnpngov_sbhosp.npx
npx/npcnpngov_spo.npx
npx/npcnpngov_unikorea.npx
npx/npcnpngov_wetax.npx
npx/npcnpnins_allianzlife.npx
npx/npcnpnins_axageneralins.npx
npx/npcnpnins_chubb.npx
npx/npcnpnins_dgbfnlife.npx
npx/npcnpnins_hana_life.npx
npx/npcnpnins_heungkukfire.npx
npx/npcnpnins_heungkukfirecyber.npx
npx/npcnpnins_heungkuklife.npx
npx/npcnpnins_hi.npx
npx/npcnpnins_hisales.npx
npx/npcnpnins_histock.npx
npx/npcnpnins_hwgeneral.npx
npx/npcnpnins_hyundailife.npx
npx/npcnpnins_hyundailifega.npx
npx/npcnpnins_kdblife.npx
npx/npcnpnins_loveageplan.npx
npx/npcnpnins_mggeneralins.npx
npx/npcnpnins_miraeassetlife.npx
npx/npcnpnins_miraeassetonline.npx
npx/npcnpnins_pcalife.npx
npx/npcnpnins_pensionheungkuklife.npx
npx/npcnpnins_pensionkdblife.npx
npx/npcnpnins_samsungfire.npx
npx/npcnpnins_samsungfire_home.npx
npx/npcnpnorg_eleckareabar.npx
npx/npcnpnorg_kftc.npx
npx/npcnpnorg_khealth.npx
npx/npcnpnorg_knia.npx
npx/npcnpnorg_kscfc.npx
npx/npcnpnorg_ksd.npx
npx/npcnpnorg_kukmin.npx
npx/npcnpnorg_sejonguni.npx
npx/npcnpnorg_tta.npx
npx/npcnpnpg_kcp.npx
npx/npcnpnpg_kicc.npx
npx/npcnpnpg_vp.npx
npx/npcnpnpreview.npx
npx/npcnpnstock_dashinstock.npx
npx/npcnpnstock_hana.npx
npx/npcnpnstock_hanahts.npx
npx/npcnpnstock_hdable.npx
npx/npcnpnstock_kdbdw.npx
npx/npcnpnstock_nhfutures.npx
npx/npcnpnstock_samsungcnt.npx
npx/npcnpnstock_shinhaninvest.npx
npx/npcnpnstock_sks.npx
npx/npcnpnstock_wtskoscom.npx
npx/npcprotectpidallowlist.npx
npx/npcrtddriver.npx
npx/npcrtdmsgbox.npx
npx/npcrtdrunregistry.npx
npx/npcrtdscandll.npx
npx/npcrtdscanfolder.npx
npx/npcscanner.npx
npx/npcscanoption.npx
npx/npcslm20.npx
npx/npcstt.npx
npx/npcsttmsgbox.npx
npx/npcstttray.npx
npx/npcsvc.npx
npx/npcurlmon.npx
npx/npcvmchk.npx
npx/nplbsc.npx
npx/nplfsav.npx
npx/nplfw.npx
npx/nplnpn.npx
npx/nplrtd.npx
npx/nplscanner.npx
npx/nplstt.npx
npx/nplsttnmmsg.npx
npx/nplsvc.npx
npx/npsmsgbox.npx
npx/npsnpninca.npx
npx/npsscanner.npx
npx/npsstt.npx
npx/npssttmsgbox.npx
sqlite3.dll
.dll windows:4 windows x86 arch:x86

06a9fae96a016b6f74249f46cea153f9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-11-2015 00:00

Not After

08-11-2016 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:6a:44:84:05:af:79:b8:a3:ef:c7:09:ab:cb:21:7e:80:c3:ee:44:1a:eb:f6:85:64:51:8b:e3:24:e4:59:82
Signer

Actual PE Digest

10:6a:44:84:05:af:79:b8:a3:ef:c7:09:ab:cb:21:7e:80:c3:ee:44:1a:eb:f6:85:64:51:8b:e3:24:e4:59:82

Digest Algorithm

sha256

PE Digest Matches

true

53:8b:ba:95:75:8c:31:f3:44:23:f7:31:28:87:46:af:2d:95:60:f8
Signer

Actual PE Digest

53:8b:ba:95:75:8c:31:f3:44:23:f7:31:28:87:46:af:2d:95:60:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npSQLite3\build\bin\release\sqlite3.pdb

Imports

kernel32

LoadLibraryW
GetStdHandle
GetProcAddress
FreeLibrary
GetCurrentProcess
SetEndOfFile
GetSystemTimeAsFileTime
LoadLibraryA
GetVersionExA
FormatMessageA
ReadFile
HeapAlloc
WriteFile
CreateFileMappingA
CloseHandle
CreateFileW
SystemTimeToFileTime
GetFullPathNameW
DeleteFileW
InitializeCriticalSection
CreateFileMappingW
GetFullPathNameA
GetCurrentProcessId
MultiByteToWideChar
QueryPerformanceCounter
GetDiskFreeSpaceA
GetTempPathA
HeapFree
WideCharToMultiByte
FlushFileBuffers
LocalFree
GetTempPathW
GetSystemTime
HeapReAlloc
AreFileApisANSI
DeleteFileA
CreateFileA
GetSystemInfo
WaitForSingleObject
Sleep
GetFileSize
InterlockedCompareExchange
GetLastError
FormatMessageW
CreateMutexW
UnlockFile
HeapCompact
GetVersionExW
HeapDestroy
HeapSize
FlushViewOfFile
LeaveCriticalSection
LockFile
GetFileAttributesA
HeapCreate
GetFileAttributesExW
SetFilePointer
WaitForSingleObjectEx
TryEnterCriticalSection
LockFileEx
DeleteCriticalSection
OutputDebugStringW
HeapValidate
EnterCriticalSection
MapViewOfFile
GetFileAttributesW
GetCurrentThreadId
GetTickCount
UnmapViewOfFile
GetDiskFreeSpaceW
OutputDebugStringA
UnlockFileEx
GetProcessHeap
GetModuleHandleA
ExitProcess
InterlockedExchange
ExitThread
CreateThread
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetFileType
GetStartupInfoA
VirtualFree
VirtualAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetModuleFileNameA
LCMapStringA
LCMapStringW
RtlUnwind
GetConsoleCP
GetConsoleMode
SetStdHandle
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 632KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

89:26:82:f7:c6:e3:56:c5:c7:42:aa:5d:d0:9c:ec:a6:55:3f:05:7f:75:cb:0e:5e:4e:51:d2:a2:bd:6f:a7:abSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 1.1MB

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 4KB - Virtual size: 3KB

b16b05115529f7bbc3cb142f11ec7320

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

b1:1c:21:24:c1:96:72:1a:17:b7:c6:69:53:68:94:d7:3b:fc:3e:7e:89:34:8c:0b:a5:11:90:b2:60:9b:4f:67Signer

2a:af:32:35:28:48:5b:ef:21:09:3e:21:b1:8e:97:42:a5:0a:0c:1dSigner

Headers

File Characteristics

PDB Paths

Imports

winhttp

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

89:26:82:f7:c6:e3:56:c5:c7:42:aa:5d:d0:9c:ec:a6:55:3f:05:7f:75:cb:0e:5e:4e:51:d2:a2:bd:6f:a7:ab
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.1MB

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

b1:1c:21:24:c1:96:72:1a:17:b7:c6:69:53:68:94:d7:3b:fc:3e:7e:89:34:8c:0b:a5:11:90:b2:60:9b:4f:67
Signer

2a:af:32:35:28:48:5b:ef:21:09:3e:21:b1:8e:97:42:a5:0a:0c:1d
Signer

.text
Size: 136KB - Virtual size: 135KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5
Signer

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de
Signer

.text
Size: 176KB - Virtual size: 174KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate