crypt32[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

crypt32.dll
Size

2.4MB
MD5

ebcccd9c28df6afcf23887063d72f849
SHA1

e9fbbf9a033acd656e420a38eae5d065e8315e7b
SHA256

e8f1d5ad06e05568db0fad2eb0aa3e87c0b8f664c2da46daedf154ad0f2dfa35
SHA512

e8fa7cf60d69d3f854d5aa8421664deba8641035038429193df4f0292e07b26e42d831cc3ac3be241b0e5c1f446ca42490bbfcbe572d71a3f9da917b22ef81c4
SSDEEP

49152:cplm5IPf4Wb93hmVi2Zg74uMXO58Yw806RsfytHra9qT:MA29xw7g749t4T

Score

1^/10

Malware Config

Signatures

Files

crypt32.dll
.dll windows:6 windows x64 arch:x64

60668e78f97403313ba8b89ca2c57614

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:0f:21:29:d3:33:d6:3d:78:a7:c7:6d:41:05:0d:c0:a1:f2:7b:7a:6f:5e:9b:97:18:68:a3:78:3a:43:b8:78
Signer

Actual PE Digest

35:0f:21:29:d3:33:d6:3d:78:a7:c7:6d:41:05:0d:c0:a1:f2:7b:7a:6f:5e:9b:97:18:68:a3:78:3a:43:b8:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

crypt32.pdb

Imports

msvcrt

_lock
_unlock
__dllonexit
_onexit
__C_specific_handler
strcmp
memset
memcpy
memcmp
atol
_initterm
malloc
free
_amsg_exit
_XcptFilter
qsort_s
_itoa_s
iswalnum
iswspace
toupper
_ultoa_s
memmove
_wcsicmp
wcsrchr
_ultow_s
_itow
wcsstr
_vsnwprintf
strncmp
_vsnprintf
isdigit
isupper
isxdigit
qsort
bsearch
_ltoa
strtoul
_ltow
iswalpha
wcstoul
wcschr
wcscmp

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegQueryValueExA
RegEnumKeyExA
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegLoadMUIStringW
RegEnumKeyExW
RegSetValueExA
RegEnumValueW
RegOpenKeyExA
RegDeleteValueW
RegCreateKeyExA
RegDeleteKeyExW
RegGetKeySecurity
RegSetKeySecurity
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForMultipleObjectsEx
ReleaseSRWLockExclusive
Sleep
WaitForSingleObjectEx
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
CreateEventA
InitializeCriticalSection

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineA
GetEnvironmentVariableA
ExpandEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-rtlsupport-l1-2-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
SetThreadToken
SetThreadStackGuarantee
CreateThread
OpenThreadToken
ExitThread
TerminateProcess
OpenProcessToken
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GetCurrentThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetVersionExA
GetSystemTime
GetSystemInfo
GetLocalTime

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-security-base-l1-2-0

GetLengthSid
IsValidSid
CopySid
RevertToSelf
ImpersonateSelf
GetSidSubAuthorityCount
FreeSid
GetSidSubAuthority
SetFileSecurityW
GetSidIdentifierAuthority
GetFileSecurityW
AddAce
AddAccessAllowedAceEx
GetAclInformation
GetSecurityDescriptorDacl
AccessCheck
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
CheckTokenCapability
GetAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
AdjustTokenPrivileges
MakeSelfRelativeSD
SetSecurityDescriptorDacl
MakeAbsoluteSD
AddAccessAllowedAce
InitializeAcl
GetSecurityDescriptorSacl
EqualSid

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-localization-l1-2-1

FormatMessageW
IdnToUnicode
IdnToAscii
GetACP

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-file-l1-2-1

FindFirstFileW
FindNextFileW
FindClose
FindNextChangeNotification
FindCloseChangeNotification
DeleteFileW
CompareFileTime
SetFilePointer
ReadFile
WriteFile
CreateFileW
FileTimeToLocalFileTime
SetEndOfFile
GetFileSize
FindFirstChangeNotificationW
GetFileAttributesExW
GetTempPathW
GetTempFileNameW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
CreateFileA

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameW
LoadStringW
FreeLibraryAndExitThread
FreeResource
LoadResource
SizeofResource
LockResource
GetModuleHandleW
FreeLibrary
GetProcAddress

api-ms-win-core-datetime-l1-1-1

GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW

api-ms-win-core-memory-l1-1-2

MapViewOfFile
VirtualProtect
VirtualAlloc
UnmapViewOfFile
VirtualQuery

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc
LocalSize
LocalReAlloc

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW
lstrcmpA
lstrlenA

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryA
FindResourceExA
CreateFileMappingA
GetComputerNameW

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-security-grouppolicy-l1-1-0

UnregisterGPNotificationInternal
RegisterGPNotificationInternal

msasn1

ASN1BERDecPeekTag
ASN1_CreateModule
ASN1DEREncOctetString
ASN1BERDecExplicitTag
ASN1BERDecMultibyteString
ASN1BERDecNotEndOfContents
ASN1_SetEncoderOption
ASN1_Decode
ASN1_Encode
ASN1objectidentifier2_cmp
ASN1BERDecObjectIdentifier2
ASN1BEREncObjectIdentifier2
ASN1BERDecOctetString
ASN1octetstring_free
ASN1open_free
ASN1BERDecOpenType
ASN1BERDecNull
ASN1BEREncU32
ASN1BERDecCharString
ASN1intx_free
ASN1charstring_free
ASN1BEREoid_free
ASN1_CloseModule
ASN1DEREncGeneralizedTime
ASN1BERDecEndOfContents
ASN1DEREncBeginBlk
ASN1DEREncCharString
ASN1DecSetError
ASN1DEREncBitString
ASN1BERDecOctetString2
ASN1char32string_free
ASN1DEREncFlushBlkElement
ASN1BERDecChar16String
ASN1BERDecUTF8String
ASN1BEREncSX
ASN1BEREncEndOfContents
ASN1BERDecGeneralizedTime
ASN1BEREncS32
ASN1BERDecEoid
ASN1DEREncNewBlkElement
ASN1DEREncEndBlk
ASN1char16string_free
ASN1EncSetError
ASN1BERDecZeroCharString
ASN1BEREncBool
ASN1BEREncExplicitTag
ASN1BERDecBool
ASN1BEREncRemoveZeroBits
ASN1BERDecOpenType2
ASN1DEREncMultibyteString
ASN1bitstring_free
ASN1BERDecBitString
ASN1DecRealloc
ASN1BEREncNull
ASN1BEREncEoid
ASN1_FreeDecoded
ASN1_FreeEncoded
ASN1_CloseEncoder
ASN1BERDecU16Val
ASN1BERDecS32Val
ASN1_CloseDecoder
ASN1_CreateEncoder
ASN1ztcharstring_free
ASN1BERDecU32Val
ASN1_CreateDecoder
ASN1BERDecSXVal
ASN1BEREoid2DotVal
ASN1Free
ASN1BERDecUTCTime
ASN1utf8string_free
ASN1DEREncUTF8String
ASN1DEREncChar16String
ASN1BERDecBitString2
ASN1BEREncOpenType
ASN1BERDecChar32String
ASN1DEREncChar32String
ASN1DEREncUTCTime
ASN1BERDotVal2Eoid

ntdll

RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
NtQueryInformationFile
EtwEventWriteFull
WinSqmIncrementDWORD
EtwEventUnregister
EvtIntReportEventAndSourceAsync
EtwEventRegister
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
NtQueryObject
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
ShipAssert

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CertAddCRLContextToStore
CertAddCRLLinkToStore
CertAddCTLContextToStore
CertAddCTLLinkToStore
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertAddEncodedCRLToStore
CertAddEncodedCTLToStore
CertAddEncodedCertificateToStore
CertAddEncodedCertificateToSystemStoreA
CertAddEncodedCertificateToSystemStoreW
CertAddEnhancedKeyUsageIdentifier
CertAddRefServerOcspResponse
CertAddRefServerOcspResponseContext
CertAddSerializedElementToStore
CertAddStoreToCollection
CertAlgIdToOID
CertCloseServerOcspResponse
CertCloseStore
CertCompareCertificate
CertCompareCertificateName
CertCompareIntegerBlob
CertComparePublicKeyInfo
CertControlStore
CertCreateCRLContext
CertCreateCTLContext
CertCreateCTLEntryFromCertificateContextProperties
CertCreateCertificateChainEngine
CertCreateCertificateContext
CertCreateContext
CertCreateSelfSignCertificate
CertDeleteCRLFromStore
CertDeleteCTLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CertDuplicateCTLContext
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCRLContextProperties
CertEnumCRLsInStore
CertEnumCTLContextProperties
CertEnumCTLsInStore
CertEnumCertificateContextProperties
CertEnumCertificatesInStore
CertEnumPhysicalStore
CertEnumSubjectInSortedCTL
CertEnumSystemStore
CertEnumSystemStoreLocation
CertFindAttribute
CertFindCRLInStore
CertFindCTLInStore
CertFindCertificateInCRL
CertFindCertificateInStore
CertFindChainInStore
CertFindExtension
CertFindRDNAttr
CertFindSubjectInCTL
CertFindSubjectInSortedCTL
CertFreeCRLContext
CertFreeCTLContext
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChainList
CertFreeCertificateContext
CertFreeServerOcspResponseContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertGetCTLContextProperty
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetIssuerCertificateFromStore
CertGetNameStringA
CertGetNameStringW
CertGetPublicKeyLength
CertGetServerOcspResponseContext
CertGetStoreProperty
CertGetSubjectCertificateFromStore
CertGetValidUsages
CertIsRDNAttrsInCertificateName
CertIsStrongHashToSign
CertIsValidCRLForCertificate
CertNameToStrA
CertNameToStrW
CertOIDToAlgId
CertOpenServerOcspResponse
CertOpenStore
CertOpenSystemStoreA
CertOpenSystemStoreW
CertRDNValueToStrA
CertRDNValueToStrW
CertRegisterPhysicalStore
CertRegisterSystemStore
CertRemoveEnhancedKeyUsageIdentifier
CertRemoveStoreFromCollection
CertResyncCertificateChainEngine
CertRetrieveLogoOrBiometricInfo
CertSaveStore
CertSelectCertificateChains
CertSerializeCRLStoreElement
CertSerializeCTLStoreElement
CertSerializeCertificateStoreElement
CertSetCRLContextProperty
CertSetCTLContextProperty
CertSetCertificateContextPropertiesFromCTLEntry
CertSetCertificateContextProperty
CertSetEnhancedKeyUsage
CertSetStoreProperty
CertStrToNameA
CertStrToNameW
CertUnregisterPhysicalStore
CertUnregisterSystemStore
CertVerifyCRLRevocation
CertVerifyCRLTimeValidity
CertVerifyCTLUsage
CertVerifyCertificateChainPolicy
CertVerifyRevocation
CertVerifySubjectCertificateContext
CertVerifyTimeValidity
CertVerifyValidityNesting
CryptAcquireCertificatePrivateKey
CryptBinaryToStringA
CryptBinaryToStringW
CryptCloseAsyncHandle
CryptCreateAsyncHandle
CryptCreateKeyIdentifierFromCSP
CryptDecodeMessage
CryptDecodeObject
CryptDecodeObjectEx
CryptDecryptAndVerifyMessageSignature
CryptDecryptMessage
CryptEncodeObject
CryptEncodeObjectEx
CryptEncryptMessage
CryptEnumKeyIdentifierProperties
CryptEnumOIDFunction
CryptEnumOIDInfo
CryptExportPKCS8
CryptExportPublicKeyInfo
CryptExportPublicKeyInfoEx
CryptExportPublicKeyInfoFromBCryptKeyHandle
CryptFindCertificateKeyProvInfo
CryptFindLocalizedName
CryptFindOIDInfo
CryptFormatObject
CryptFreeOIDFunctionAddress
CryptGetAsyncParam
CryptGetDefaultOIDDllList
CryptGetDefaultOIDFunctionAddress
CryptGetKeyIdentifierProperty
CryptGetMessageCertificates
CryptGetMessageSignerCount
CryptGetOIDFunctionAddress
CryptGetOIDFunctionValue
CryptHashCertificate
CryptHashCertificate2
CryptHashMessage
CryptHashPublicKeyInfo
CryptHashToBeSigned
CryptImportPKCS8
CryptImportPublicKeyInfo
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfoEx2
CryptInitOIDFunctionSet
CryptInstallDefaultContext
CryptInstallOIDFunctionAddress
CryptLoadSip
CryptMemAlloc
CryptMemFree
CryptMemRealloc
CryptMsgCalculateEncodedLength
CryptMsgClose
CryptMsgControl
CryptMsgCountersign
CryptMsgCountersignEncoded
CryptMsgDuplicate
CryptMsgEncodeAndSignCTL
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgOpenToEncode
CryptMsgSignCTL
CryptMsgUpdate
CryptMsgVerifyCountersignatureEncoded
CryptMsgVerifyCountersignatureEncodedEx
CryptObjectLocatorFree
CryptObjectLocatorGet
CryptObjectLocatorGetContent
CryptObjectLocatorGetUpdated
CryptObjectLocatorInitialize
CryptObjectLocatorIsChanged
CryptObjectLocatorRelease
CryptProtectData
CryptProtectMemory
CryptQueryObject
CryptRegisterDefaultOIDFunction
CryptRegisterOIDFunction
CryptRegisterOIDInfo
CryptRetrieveTimeStamp
CryptSIPAddProvider
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetSealedDigest
CryptSIPGetSignedDataMsg
CryptSIPLoad
CryptSIPPutSignedDataMsg
CryptSIPRemoveProvider
CryptSIPRemoveSignedDataMsg
CryptSIPRetrieveSubjectGuid
CryptSIPRetrieveSubjectGuidForCatalogFile
CryptSIPVerifyIndirectData
CryptSetAsyncParam
CryptSetKeyIdentifierProperty
CryptSetOIDFunctionValue
CryptSignAndEncodeCertificate
CryptSignAndEncryptMessage
CryptSignCertificate
CryptSignMessage
CryptSignMessageWithKey
CryptStringToBinaryA
CryptStringToBinaryW
CryptUninstallDefaultContext
CryptUnprotectData
CryptUnprotectMemory
CryptUnregisterDefaultOIDFunction
CryptUnregisterOIDFunction
CryptUnregisterOIDInfo
CryptUpdateProtectedState
CryptVerifyCertificateSignature
CryptVerifyCertificateSignatureEx
CryptVerifyDetachedMessageHash
CryptVerifyDetachedMessageSignature
CryptVerifyMessageHash
CryptVerifyMessageSignature
CryptVerifyMessageSignatureWithKey
CryptVerifyTimeStampSignature
I_CertDiagControl
I_CertProtectFunction
I_CertSrvProtectFunction
I_CertSyncStore
I_CertUpdateStore
I_CryptAddRefLruEntry
I_CryptAddSmartCardCertToStore
I_CryptAllocTls
I_CryptCreateLruCache
I_CryptCreateLruEntry
I_CryptDetachTls
I_CryptDisableLruOfEntries
I_CryptEnableLruOfEntries
I_CryptEnumMatchingLruEntries
I_CryptFindLruEntry
I_CryptFindLruEntryData
I_CryptFindSmartCardCertInStore
I_CryptFlushLruCache
I_CryptFreeLruCache
I_CryptFreeTls
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
I_CryptGetDefaultCryptProv
I_CryptGetDefaultCryptProvForEncrypt
I_CryptGetFileVersion
I_CryptGetLruEntryData
I_CryptGetLruEntryIdentifier
I_CryptGetOssGlobal
I_CryptGetTls
I_CryptInsertLruEntry
I_CryptInstallAsn1Module
I_CryptInstallOssGlobal
I_CryptReadTrustedPublisherDWORDValueFromRegistry
I_CryptRegisterSmartCardStore
I_CryptReleaseLruEntry
I_CryptRemoveLruEntry
I_CryptSetTls
I_CryptTouchLruEntry
I_CryptUninstallAsn1Module
I_CryptUninstallOssGlobal
I_CryptUnregisterSmartCardStore
I_CryptWalkAllLruCacheEntries
I_PFXImportCertStoreEx
PFXExportCertStore
PFXExportCertStore2
PFXExportCertStoreEx
PFXImportCertStore
PFXIsPFXBlob
PFXVerifyPassword

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60668e78f97403313ba8b89ca2c57614

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

35:0f:21:29:d3:33:d6:3d:78:a7:c7:6d:41:05:0d:c0:a1:f2:7b:7a:6f:5e:9b:97:18:68:a3:78:3a:43:b8:78Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-security-grouppolicy-l1-1-0

msasn1

ntdll

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: 25KB - Virtual size: 24KB

.pdata Size: 72KB - Virtual size: 71KB

.idata Size: 13KB - Virtual size: 13KB

.didat Size: 1024B - Virtual size: 904B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

35:0f:21:29:d3:33:d6:3d:78:a7:c7:6d:41:05:0d:c0:a1:f2:7b:7a:6f:5e:9b:97:18:68:a3:78:3a:43:b8:78
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 25KB - Virtual size: 24KB

.pdata
Size: 72KB - Virtual size: 71KB

.idata
Size: 13KB - Virtual size: 13KB

.didat
Size: 1024B - Virtual size: 904B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 7KB - Virtual size: 7KB