b46b1dd2533ce7c616aa5ee410d95e8086720b7885b9fcd03e5f6a055e5ab028

Sharing

Copy URL Twitter E-mail

General

Target

b46b1dd2533ce7c616aa5ee410d95e8086720b7885b9fcd03e5f6a055e5ab028
Size

5.8MB
MD5

29983ef2a7c2eaf022b58cb8763bae7c
SHA1

2fea56a528863e6810d04cc2f53a77f192a8fa2b
SHA256

b46b1dd2533ce7c616aa5ee410d95e8086720b7885b9fcd03e5f6a055e5ab028
SHA512

a4157598324bb769b840df93005e1b660ad8710469e74ef64181cbcacd3ad17e79f21f61767a8ffda5e5dd35a8f914d081c36f85c34371d3434f1946449cce82
SSDEEP

98304:kmXYctpgrhJ2Tpi7F0jlioJHVLMegbQbKr4gQkKaggPgGcIsYilrmtyhrsIuCmSr:NYc0r32di7i3HVZHbK+kKLUgEsRlFBlt

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7z.dll
unpack001/SqliteCLibX86.dll
unpack001/_6576B57AEF624E0C61447A0675F18EC5
unpack001/taskmgr.exe

Files

b46b1dd2533ce7c616aa5ee410d95e8086720b7885b9fcd03e5f6a055e5ab028
.zip
7z.dll
.dll windows:4 windows x86 arch:x86

6a7be52633b01426b17d148203c82793

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear

user32

CharPrevExA
CharUpperW

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

.text
Size: 885KB - Virtual size: 885KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AutomaticSearch.exe
.exe windows:5 windows x86 arch:x86

a8289ce4186d91574885fecdb6300d4d

Code Sign

04:44:c0
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

22/10/2008, 12:07

Not After

31/12/2029, 12:07

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:4c:a9:11:3e:5b:72:b9:ba:3e:68:ad:3a:a7:9a:6f
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

13/08/2018, 10:01

Not After

13/11/2019, 10:01

Subject

CN=Shenzhen Shangzhou Net Technology Co.\, Ltd.,O=Shenzhen Shangzhou Net Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c11323539373531383436304071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:63:a1:47:72:e5:c3:5d:29:60:75:d6:3c:00:e5:3c:75:7e:78:76:b3:0a:d6:70:29:08:2b:fc:25:65:0b:3f
Signer

Actual PE Digest

9e:63:a1:47:72:e5:c3:5d:29:60:75:d6:3c:00:e5:3c:75:7e:78:76:b3:0a:d6:70:29:08:2b:fc:25:65:0b:3f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\SVN\AutoClickTest\AutomaticSearch\Release\AutomaticSearch.pdb

Imports

mfc120u

ord8698
ord13990
ord14092
ord8226
ord4433
ord13402
ord13403
ord4349
ord2525
ord2535
ord12214
ord3259
ord3557
ord3558
ord8594
ord13622
ord545
ord2290
ord5605
ord11867
ord1945
ord12981
ord3806
ord1944
ord11866
ord12755
ord7046
ord7337
ord7397
ord533
ord1165
ord4317
ord5327
ord12899
ord3137
ord10385
ord5179
ord8347
ord8636
ord9182
ord12397
ord9306
ord9349
ord10646
ord11963
ord11456
ord6870
ord13991
ord971
ord1445
ord5603
ord9364
ord881
ord9107
ord5433
ord2638
ord6773
ord9573
ord4939
ord4938
ord4940
ord4937
ord4936
ord9137
ord12054
ord2719
ord13614
ord6122
ord8186
ord11156
ord11159
ord9390
ord9405
ord9395
ord9867
ord9872
ord9407
ord10998
ord7702
ord8793
ord11621
ord9410
ord11003
ord8892
ord11027
ord9928
ord9929
ord7671
ord6839
ord11357
ord10197
ord10205
ord11399
ord10285
ord11756
ord9921
ord9369
ord10157
ord11125
ord11608
ord10230
ord10130
ord11609
ord10193
ord10734
ord8885
ord11480
ord11045
ord9143
ord9381
ord9382
ord11552
ord11048
ord10865
ord11061
ord11769
ord11553
ord10619
ord11478
ord10163
ord11532
ord10735
ord8707
ord2509
ord4010
ord8708
ord2397
ord7004
ord4196
ord3324
ord3218
ord6123
ord13616
ord9019
ord12095
ord6020
ord6743
ord999
ord1449
ord3654
ord5019
ord12430
ord8658
ord7954
ord4442
ord2214
ord8699
ord14367
ord6966
ord7375
ord7361
ord850
ord1369
ord12758
ord9389
ord9404
ord9866
ord9871
ord9394
ord9406
ord4973
ord2954
ord8705
ord14270
ord14276
ord13623
ord1554
ord5029
ord6302
ord1542
ord1172
ord5604
ord12187
ord2847
ord4984
ord13328
ord13996
ord8657
ord8654
ord5437
ord6868
ord12804
ord13721
ord6258
ord8005
ord13724
ord8008
ord4104
ord3881
ord3252
ord3253
ord5864
ord6398
ord4562
ord4563
ord4560
ord1049
ord324
ord1360
ord832
ord7357
ord4280
ord3803
ord1684
ord2435
ord8639
ord1521
ord12792
ord290
ord2347
ord12006
ord8921
ord10896
ord11271
ord3362
ord3361
ord3122
ord6121
ord13612
ord3263
ord3260
ord8092
ord2718
ord10166
ord10168
ord10167
ord10165
ord10169
ord5557
ord11600
ord11601
ord9020
ord11964
ord3795
ord11811
ord14447
ord8846
ord12048
ord6875
ord10883
ord9116
ord3224
ord13738
ord12134
ord12132
ord1711
ord1723
ord1731
ord1727
ord1736
ord4879
ord4920
ord4887
ord4899
ord4895
ord4891
ord4928
ord4916
ord4883
ord4932
ord4905
ord4867
ord4874
ord4909
ord4459
ord9574
ord4451
ord3013
ord14449
ord7807
ord14455
ord6774
ord11592
ord13563
ord5838
ord2640
ord11999
ord3898
ord3330
ord3329
ord3223
ord12043
ord5693
ord10136
ord9091
ord3790
ord14094
ord10353
ord7384
ord1110
ord6392
ord6469
ord3839
ord2262
ord1108
ord462
ord12634
ord4621
ord14265
ord8638
ord8242
ord8352
ord8268
ord12736
ord8206
ord5262
ord2444
ord12412
ord12413
ord14448
ord7806
ord14454
ord9279
ord4109
ord4047
ord12818
ord7825
ord1992
ord11857
ord11858
ord14326
ord12402
ord7884
ord14526
ord6251
ord14528
ord6253
ord14527
ord6252
ord3809
ord5821
ord12114
ord12122
ord4546
ord8099
ord10314
ord12126
ord12094
ord12799
ord5157
ord5454
ord5664
ord9231
ord5430
ord5667
ord5160
ord5316
ord5137
ord7609
ord7610
ord7600
ord5314
ord8101
ord10131
ord9090
ord6758
ord2948
ord2367
ord4049
ord1518
ord4772
ord286
ord285
ord5824
ord2967
ord280
ord13771
ord7206
ord13302
ord949
ord2163
ord7881
ord1648
ord5323
ord6652
ord14516
ord12276
ord2341
ord14463
ord12219
ord2336
ord2343
ord1520
ord1467
ord992
ord7542
ord10260
ord266
ord265
ord296
ord1042
ord8346
ord2204
ord1658
ord1506
ord8801
ord1508

msvcr120

_calloc_crt
__dllonexit
_onexit
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
memmove_s
_wstrtime
_wstrdate
_vsnwprintf
_snwprintf
_swprintf
sscanf
_purecall
_recalloc
memcpy
calloc
_unlock
?terminate@@YAXXZ
srand
wcscat_s
ceil
__CxxFrameHandler3
wcscpy_s
swprintf_s
wcsrchr
wcsftime
_mktime64
_localtime64_s
_time64
rand
_wtoi
__argc
__wargv
memcpy_s
??0bad_cast@std@@QAE@PBD@Z
_CxxThrowException
_lock
??1type_info@@UAE@XZ
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
memchr
__crtGetShowWindowMode
_XcptFilter
free
memset
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
_amsg_exit
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
memmove

kernel32

ReadFile
LoadLibraryW
GetProcAddress
FreeLibrary
GetLastError
LocalFree
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreatePipe
InitializeCriticalSectionAndSpinCount
CreateProcessW
DecodePointer
GetPrivateProfileIntW
OutputDebugStringW
lstrcatW
MoveFileExW
DeviceIoControl
CreateFileW
GetFileSize
WriteFile
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
CloseHandle
GetCurrentProcess
Sleep
WritePrivateProfileStringW
GetStartupInfoW
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GlobalLock
SetFilePointer
GlobalAlloc
GlobalUnlock
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

UnhookWindowsHookEx
SystemParametersInfoW
SetWindowPos
SetTimer
KillTimer
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowsHookExW
GetKeyboardState
SetKeyboardState
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
VkKeyScanW
CallNextHookEx
GetWindowTextW
IsWindow
AdjustWindowRectEx
GetWindowRect
wsprintfW
SetWindowLongW
GetWindowLongW
EnableWindow
GetClientRect
SendMessageW
PostMessageW

advapi32

RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCreateKeyW
RegOpenKeyW
RegEnumKeyExW
RegQueryValueExW

comctl32

InitCommonControlsEx

oleaut32

VariantInit
VariantClear
SysAllocString
SysStringLen
SysFreeString

urlmon

UrlMkSetSessionOption
ObtainUserAgentString
CoInternetSetFeatureEnabled
CoInternetIsFeatureEnabled

msvcp120

?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?classic@locale@std@@SAABV12@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

iphlpapi

GetAdaptersAddresses

wininet

FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW

Sections

.text
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FileAssociation.dll
.dll windows:5 windows x86 arch:x86

2a1fb9631a46ba5cb1034aec8f44cdf7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:11:5f:ca:66:52:08:ed:5a:e6:32:36:96:ea:9c:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/06/2023, 00:00

Not After

03/06/2025, 23:59

Subject

CN=Beijing Hitencent Technology Co. Ltd.,O=Beijing Hitencent Technology Co. Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:5c:f5:8b:0a:ce:80:09:9a:ee:d1:9a:a4:89:c5:a2:85:0f:25:db:9c:e7:8e:79:b3:7e:f8:cf:db:96:4a:ed
Signer

Actual PE Digest

5b:5c:f5:8b:0a:ce:80:09:9a:ee:d1:9a:a4:89:c5:a2:85:0f:25:db:9c:e7:8e:79:b3:7e:f8:cf:db:96:4a:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\works\common_lib\bin\FileAssociation.pdb

Imports

kernel32

FlushInstructionCache
WriteProcessMemory
VirtualProtect
LocalAlloc
GetCurrentProcess
SystemTimeToFileTime
FileTimeToSystemTime
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
LocalFree
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
SetFilePointerEx
WriteFile
CreateFileW
GetProcessHeap
EncodePointer
GetCommandLineA
GetCurrentThreadId
RtlUnwind
GetFileType
GetConsoleMode
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
SetStdHandle
GetConsoleCP
LoadLibraryExW
LCMapStringW
WriteConsoleW
FlushFileBuffers
HeapFree
HeapAlloc
CloseHandle
HeapReAlloc

user32

wsprintfA

advapi32

CryptHashData
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
ConvertSidToStringSidW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegQueryInfoKeyA
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
GetUserNameW
CryptDestroyHash

ole32

CoCreateInstance
CoInitialize

shlwapi

SHDeleteKeyW

Exports

Exports

CreateFileAssociation
DestroyFileAssociation

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
JisuPdf.exe
.exe windows:5 windows x86 arch:x86

97538df995d73d00bf2e5bf80eb59173

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:11:5f:ca:66:52:08:ed:5a:e6:32:36:96:ea:9c:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/06/2023, 00:00

Not After

03/06/2025, 23:59

Subject

CN=Beijing Hitencent Technology Co. Ltd.,O=Beijing Hitencent Technology Co. Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:7c:55:68:1f:64:44:ff:79:e1:88:ec:7e:53:d4:35:fa:c2:19:27:73:38:02:b9:48:e2:75:cc:e8:5e:8b:f6
Signer

Actual PE Digest

6e:7c:55:68:1f:64:44:ff:79:e1:88:ec:7e:53:d4:35:fa:c2:19:27:73:38:02:b9:48:e2:75:cc:e8:5e:8b:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\works\jisupdf\obj-rel\JisuPdf.pdb

Imports

advapi32

RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExA
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyW
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptReleaseContext
CryptImportKey
CryptAcquireContextW
GetTokenInformation
OpenProcessToken

kernel32

DeleteFileA
InitializeCriticalSection
ResetEvent
CreateEventA
GetModuleFileNameA
GetFullPathNameA
GetSystemDirectoryW
GetWindowsDirectoryW
CreateThread
GlobalDeleteAtom
GlobalAddAtomW
MulDiv
QueryPerformanceCounter
SetThreadExecutionState
QueryPerformanceFrequency
GetLogicalDrives
WriteFile
CreateEventW
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
TerminateProcess
GetFileSize
GetDateFormatW
GetTimeFormatW
GetUserDefaultUILanguage
FindNextFileW
AllocConsole
CreateProcessW
SetConsoleScreenBufferSize
FormatMessageA
GetLocaleInfoW
GetStdHandle
GetConsoleScreenBufferInfo
GetTempFileNameW
GetDriveTypeW
GetVolumePathNameW
GetFileSizeEx
GetLongPathNameW
GetFileTime
GetFileAttributesExW
GetShortPathNameW
GetFileInformationByHandle
CompareFileTime
ReadDirectoryChangesW
WaitForMultipleObjectsEx
QueueUserAPC
CancelIo
TryEnterCriticalSection
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
ConnectNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
GetACP
GetEnvironmentVariableW
GetTempPathA
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetSystemTime
FileTimeToDosDateTime
GetTimeZoneInformation
CreateProcessA
WriteConsoleW
LCMapStringW
CompareStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetEndOfFile
PeekNamedPipe
FileTimeToLocalFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetStartupInfoW
UnhandledExceptionFilter
GetStringTypeW
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleHandleExW
GetFileType
SetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetCommandLineA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
RtlUnwind
AreFileApisANSI
ExitThread
EncodePointer
SetNamedPipeHandleState
DisconnectNamedPipe
GetOverlappedResult
SetFilePointerEx
IsDebuggerPresent
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ExitProcess
HeapReAlloc
CreateFileA
CreateMutexW
FindFirstFileW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
FindResourceExW
FindResourceW
FreeLibrary
LoadResource
HeapAlloc
LoadLibraryExW
CreateToolhelp32Snapshot
Process32NextW
GetExitCodeProcess
Process32FirstW
SetErrorMode
GetCommandLineW
GetFullPathNameW
lstrcpyW
SetFileAttributesW
LocalFree
GetCurrentProcessId
DeleteFileW
CloseHandle
ReleaseMutex
DuplicateHandle
SystemTimeToFileTime
VerSetConditionMask
MoveFileExW
GetCurrentProcess
HeapFree
CreateDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
GetSystemDefaultLCID
OutputDebugStringW
GetModuleHandleW
GetTickCount
GetProcessHeap
GetCurrentThreadId
DeleteCriticalSection
OpenEventW
lstrcatW
lstrcmpiW
DecodePointer
LockResource
CreateFileMappingW
LocalAlloc
GetLocalTime
FindClose
GlobalFree
EnterCriticalSection
HeapSize
GetProcAddress
SetLastError
GetPrivateProfileStringW
OpenProcess
GlobalAlloc
WideCharToMultiByte
LoadLibraryW
InitializeCriticalSectionAndSpinCount
Sleep
CopyFileW
SizeofResource
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
lstrcpynW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
lstrcmpW
MultiByteToWideChar
lstrlenW
WritePrivateProfileStringW
GlobalUnlock
FlushInstructionCache
GetTempPathW
RaiseException
GetPrivateProfileIntW
VerifyVersionInfoW
GetLastError
GetCurrentDirectoryW
OutputDebugStringA

user32

DrawFrameControl
GetCursor
DialogBoxIndirectParamW
SendDlgItemMessageW
CheckDlgButton
IsDlgButtonChecked
CheckRadioButton
SetDlgItemTextW
DrawTextW
CharLowerW
HideCaret
CopyImage
ShowCaret
FillRect
TrackMouseEvent
SendMessageA
SetWindowLongA
GetWindowLongA
DefWindowProcA
CallWindowProcA
UnregisterHotKey
RegisterHotKey
GetMessagePos
ShowWindowAsync
ReuseDDElParam
MessageBeep
IsWindowUnicode
UnpackDDElParam
TrackPopupMenu
GetMenuItemID
SetMenuItemBitmaps
CreateMenu
ModifyMenuW
GetMenu
CheckMenuRadioItem
AppendMenuW
CreatePopupMenu
InsertMenuW
TranslateAcceleratorW
LoadAcceleratorsW
LoadIconW
LoadBitmapW
FindWindowExW
AllowSetForegroundWindow
EndPaint
ClientToScreen
DestroyWindow
SetCursor
GetWindowTextLengthW
CloseClipboard
UpdateLayeredWindow
MapVirtualKeyW
SetWindowRgn
SetTimer
ScreenToClient
GetWindowRect
IsMenu
GetMessageW
MonitorFromPoint
PostQuitMessage
CharNextW
GetWindowDC
IsIconic
LoadImageW
SetCapture
UnregisterClassW
PostMessageW
KillTimer
IsZoomed
GetKeyState
GetSubMenu
SetActiveWindow
DispatchMessageW
IsRectEmpty
MoveWindow
GetWindow
GetWindowThreadProcessId
CopyRect
CheckMenuItem
DefWindowProcW
CallWindowProcW
GetMonitorInfoW
GetScrollPos
SetScrollInfo
SetMenuItemInfoW
EndDeferWindowPos
DestroyIcon
SetWindowTextW
GetDlgCtrlID
DestroyMenu
SetClipboardData
EnableWindow
UpdateWindow
MapWindowPoints
SendMessageW
IsWindowVisible
GetSystemMetrics
BeginDeferWindowPos
ReleaseCapture
MessageBoxW
DeferWindowPos
UnhookWindowsHookEx
OpenClipboard
EqualRect
SetWindowsHookExW
CreateWindowExW
RemoveMenu
ShowScrollBar
IsWindow
GetMenuItemCount
CreateDialogParamW
SendMessageTimeoutW
SetMenu
ShowWindow
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
GetSysColor
GetDesktopWindow
DestroyCursor
RedrawWindow
EndDialog
SetWindowLongW
GetDlgItem
MonitorFromWindow
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
SetClassLongW
SystemParametersInfoW
GetWindowTextW
GetClipboardData
GetAncestor
GetWindowLongW
LoadMenuW
InvalidateRect
UnionRect
GetScrollInfo
RegisterClipboardFormatA
TrackPopupMenuEx
OffsetRect
RegisterClassExW
GetForegroundWindow
InflateRect
ShowCursor
LockWindowUpdate
IsCharAlphaNumericW
DdeInitializeW
EnumDisplayMonitors
DdeCreateStringHandleW
GetWindowInfo
DdeFreeStringHandle
DdeUninitialize
AdjustWindowRectEx
DdeClientTransaction
DdeConnect
DdeDisconnect
DdeFreeDataHandle
DrawIconEx
TranslateMessage
GetCapture
GetDC
SetPropW
GetDoubleClickTime
wsprintfW
IsCharUpperW
GetClassInfoExW
PtInRect
GetClassLongW
BeginPaint
SetRectEmpty
GetMenuItemInfoW
SetFocus
GetClientRect
FindWindowW
SetParent
WindowFromPoint
CharLowerBuffW
CallNextHookEx
LoadCursorW
AttachThreadInput
GetParent
DialogBoxParamW
GetFocus
DeleteMenu
SetForegroundWindow
MonitorFromRect

gdi32

CreateRectRgn
SetGraphicsMode
GetDIBits
SetDIBColorTable
SetDIBits
GetDIBColorTable
PatBlt
SetBrushOrgEx
CreateBitmap
CreatePatternBrush
SetROP2
SetLayout
SelectClipRgn
RoundRect
TextOutW
CreateFontIndirectW
SetWorldTransform
EndPage
StartPage
StretchBlt
CreateDCW
SetMapMode
SetStretchBltMode
StartDocW
EndDoc
AbortDoc
GetStockObject
MoveToEx
BitBlt
GetTextExtentPoint32W
SetViewportOrgEx
LineTo
SetTextColor
DeleteDC
CreateDIBSection
GetDeviceCaps
GetCurrentObject
SetBkColor
ExcludeClipRect
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
CreateCompatibleBitmap
Rectangle
ExtTextOutW
CreateFontW
GetObjectW
CreateRoundRectRgn
CreatePen
CreateDiscardableBitmap
CreateSolidBrush

comdlg32

CommDlgExtendedError
PrintDlgExW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW

shell32

SHBindToParent
SHChangeNotify
SHGetDesktopFolder
DragFinish
DragQueryFileW
SHGetFolderPathW
SHGetFileInfoW
SHGetPathFromIDListW
ShellExecuteW
DragAcceptFiles
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExW
SHAddToRecentDocs
ord171

gdiplus

GdipGetPathWorldBoundsI
GdipTransformPath
GdipDeleteMatrix
GdipCreateBitmapFromGdiDib
GdipDrawImageI
GdipCreateBitmapFromGraphics
GdipAddPathLine
GdipGetImageHorizontalResolution
GdipDrawRectangle
GdipGetFamilyName
GdipSetPenDashArray
GdipSetWorldTransform
GdipGetFamily
GdipTransformMatrixPoints
GdipInvertMatrix
GdipSetPenDashOffset
GdipSetImageAttributesWrapMode
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipGetFontCollectionFamilyList
GdipSetImageAttributesColorMatrix
GdipGetEmHeight
GdipAddPathPath
GdipFillPolygon
GdipPrivateAddFontFile
GdipSetClipRect
GdipDrawImagePointsRect
GdipSetPageScale
GdipGetDpiY
GdipGetFontCollectionFamilyCount
GdipGetMatrixElements
GdipTransformRegion
GdipGraphicsClear
GdipCreateRegionRectI
GdipSetPenLineCap197819
GdipWidenPath
GdipIsStyleAvailable
GdipSetPenMode
GdipCreateMatrix2
GdipSetImagePalette
GdipNewPrivateFontCollection
GdipGetWorldTransform
GdipDeletePrivateFontCollection
GdipSetPenTransform
GdipGetCellAscent
GdipRestoreGraphics
GdipCloneFontFamily
GdipSetPixelOffsetMode
GdipGetClipBounds
GdipSetStringFormatFlags
GdipDeleteBrush
GdipFree
GdipDeletePen
GdipGetSmoothingMode
GdipCloneBrush
GdipCloneBitmapAreaI
GdipRotateMatrix
GdipGetImageHeight
GdipDrawImageRectRectI
GdipMeasureString
GdipSetStringFormatLineAlign
GdipScaleMatrix
GdipFillEllipseI
GdipScaleWorldTransform
GdipCreateRegion
GdipGetClip
GdipSetClipRegion
GdipSetInterpolationMode
GdipGetFontHeight
GdipSetPenLineJoin
GdipSetPenStartCap
GdipGetPenWidth
GdipSetPenEndCap
GdipDrawBezier
GdipSetPenMiterLimit
GdipAddPathBezierI
GdipWindingModeOutline
GdipCreateMatrix
GdipCreateLineBrushFromRect
GdipGetStringFormatFlags
GdipGetLogFontW
GdipStringFormatGetGenericTypographic
GdipSaveGraphics
GdipMeasureCharacterRanges
GdipDrawPath
GdipDeleteFont
GdipAddPathRectangleI
GdipFillPolygonI
GdipDrawImageRectRect
GdipCreateFromHWND
GdipFillPath
GdipSetCompositingQuality
GdipSetSolidFillColor
GdipTranslateWorldTransform
GdipSetCompositingMode
GdipCloneStringFormat
GdipDeleteRegion
GdipSetPageUnit
GdipCreateRegionPath
GdipSetPenColor
GdipCreatePen2
GdipClosePathFigure
GdipSetTextRenderingHint
GdipSetStringFormatMeasurableCharacterRanges
GdipTranslateMatrix
GdipGetRegionBounds
GdipBitmapSetResolution
GdipStartPathFigure
GdipCreatePath2
GdipCreateBitmapFromScan0
GdipCreateFromHDC2
GdipDeleteGraphics
GdipAddPathEllipseI
GdipSetClipRectI
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetStringFormatAlign
GdipCreateBitmapFromStream
GdipSetSmoothingMode
GdipAddPathLineI
GdipGetDpiX
GdipCreateTexture
GdipDrawEllipseI
GdipDeleteFontFamily
GdipBitmapUnlockBits
GdipAddPathArcI
GdipCreateSolidFill
GdipAlloc
GdipGetImageEncodersSize
GdipGetRegionHRgn
GdipGetPointCount
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdiplusStartup
GdipDrawRectangleI
GdipDeleteStringFormat
GdipCreatePen1
GdipReleaseDC
GdipGetImageWidth
GdipCreatePath
GdipSetStringFormatTrimming
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipDrawLineI
GdipSetClipPath
GdipCloneImage
GdipFillRectangleI
GdipBitmapLockBits
GdipDrawLine
GdipDrawImageRect
GdipSaveImageToFile
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipFillRectangle
GdipGetDC
GdipDrawString
GdipGetImageEncoders
GdipGetGenericFontFamilySansSerif
GdipClonePath
GdipCreateBitmapFromHBITMAP
GdipDeletePath
GdipCreateFont
GdipCreateBitmapFromFile
GdipDisposeImage
GdipSetPropertyItem

ole32

CoGetMalloc
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemRealloc
ReleaseStgMedium
CoInitialize

comctl32

ImageList_GetIconSize
ImageList_Draw
CreatePropertySheetPageW
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_Create
ImageList_AddMasked
InitCommonControlsEx
_TrackMouseEvent
ImageList_Destroy

msimg32

AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
GetPrinterW
ClosePrinter
DeviceCapabilitiesW
ord203

urlmon

CoInternetGetSession

oleaut32

SysFreeString
SafeArrayPutElement
SafeArrayCreateVector
VariantCopy
SysAllocString
VarUI4FromStr
SysAllocStringLen
VariantInit
VariantClear

shlwapi

SHDeleteValueW
PathFileExistsW
SHGetValueW
SHDeleteKeyW
SHSetValueW
PathUnquoteSpacesW
PathRemoveArgsW
PathFileExistsA
ord219
PathIsRelativeW
StrStrW
StrRStrIW
StrStrIW
PathAppendW
PathIsNetworkPathW
PathFindFileNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

sqlite3

sqlite3_exec
sqlite3_open
sqlite3_free_table
sqlite3_errmsg
sqlite3_free
sqlite3_get_table
sqlite3_close

winhttp

WinHttpGetIEProxyConfigForCurrentUser

libcurl

curl_easy_getinfo
curl_easy_perform
curl_easy_setopt
curl_easy_cleanup
curl_easy_init
curl_global_init

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data:
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lvkrnu.dll
.dll windows:6 windows x86 arch:x86

bda7da97d950ba20351b10118ed77e4e

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

95:c4:9a:e7:84:89:cc:32
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

16/07/2019, 00:31

Not After

11/07/2022, 19:58

Subject

CN=LEAD Technologies\, Inc.,O=LEAD Technologies\, Inc.,L=Charlotte,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8d:84:4c:4c:c6:f0:1d:82:84:cf:cc:40:54:80:b3:db:14:c3:c4:8a:c9:aa:57:10:00:7c:45:e2:d6:0a:aa:8e
Signer

Actual PE Digest

8d:84:4c:4c:c6:f0:1d:82:84:cf:cc:40:54:80:b3:db:14:c3:c4:8a:c9:aa:57:10:00:7c:45:e2:d6:0a:aa:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
CloseHandle
MultiByteToWideChar
GetLastError
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalSize
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
LCMapStringW
DecodePointer
GetFileType
GetStdHandle
GetACP
HeapAlloc
HeapFree
CreateFileW
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
RaiseException
InterlockedFlushSList
RtlUnwind
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

UnionRect
PtInRect
IntersectRect
SetRect
CopyRect
FillRect
GetClipboardData
CloseClipboard
SetClipboardData
OpenClipboard
IsClipboardFormatAvailable
CopyImage
RegisterClipboardFormatA

gdi32

GetEnhMetaFileHeader
EnumFontFamiliesExW
GetTextExtentPoint32A
TextOutA
GetTextExtentPoint32W
ExtTextOutW
SetTextAlign
PolyBezier
Polyline
PolyBezierTo
Rectangle
LineTo
StrokeAndFillPath
FillPath
AbortPath
GetOutlineTextMetricsW
GetTextMetricsW
Ellipse
Polygon
PatBlt
SelectClipPath
GetObjectType
SetROP2
SetTextColor
GetStockObject
GetBkMode
GetNearestPaletteIndex
GetPaletteEntries
GetObjectW
GetClipRgn
SelectClipRgn
BitBlt
PtInRegion
GetPixel
SetPixel
SelectObject
SelectPalette
RealizePalette
SetPaletteEntries
SaveDC
SetPolyFillMode
BeginPath
PolyDraw
EndPath
RestoreDC
GetDeviceCaps
SetBkMode
GetWinMetaFileBits
GetMetaFileBitsEx
SetWinMetaFileBits
EnumEnhMetaFile
GetPath
PlayEnhMetaFileRecord
GetROP2
LPtoDP
GetPolyFillMode
GetCurrentObject
GetWorldTransform
ModifyWorldTransform
SetWorldTransform
GetRgnBox
GetTextAlign
MoveToEx
GetTextColor
SetBkColor

shell32

ShellExecuteW

ltkrnu

ord293
ord269
ord302
ord318
ord309
ord1043
ord335
ord336
ord337
ord1402
ord98
ord108
ord64
ord24
ord47
ord334
ord314
ord260
ord284
ord331
ord58
ord116
ord37
ord332
ord270
ord320
ord313
ord106
ord200
ord197
ord188
ord185
ord1419
ord184
ord422
ord1505
ord1501
ord187
ord183
ord14
ord52
ord72
ord45
ord234
ord305
ord306
ord204
ord26
ord67
ord316
ord999
ord138
ord137
ord135
ord271

ltfilu

ord96
ord67
ord145

ltdisu

ord87
ord82
ord107

ltimgefxu

ord6

ltdrwu

ord80
ord85
ord86
ord88
ord82

Exports

Exports

L_VecAddGroup
L_VecAddGroupA
L_VecAddHyperlink
L_VecAddHyperlinkA
L_VecAddLayer
L_VecAddLayerA
L_VecAddObject
L_VecAddObjectA
L_VecAddObjectToGroup
L_VecAddObjectToGroupA
L_VecApplyTransformation
L_VecArrayAdd
L_VecArrayAddFast
L_VecArrayCopy
L_VecArrayDumpSave
L_VecArrayFree
L_VecArrayGet
L_VecArrayRemove
L_VecArrayRemoveAll
L_VecArrayReplace
L_VecArrayReset
L_VecAttachToWindow
L_VecBezierTo
L_VecBezierToLine
L_VecCalculateTextParallelogram
L_VecCheckIfLocked
L_VecClipboardReady
L_VecConvertFromEMF
L_VecConvertFromEMFExt
L_VecConvertFromWMF
L_VecConvertPointFromUnit
L_VecConvertPointToUnit
L_VecConvertToEMF
L_VecConvertToWMF
L_VecCopy
L_VecCopyFromClipboard
L_VecCopyGroup
L_VecCopyLayer
L_VecCopyObject
L_VecCopyToClipboard
L_VecCreatePolyPoint
L_VecDeleteGroup
L_VecDeleteGroupClones
L_VecDeleteLayer
L_VecDeleteObject
L_VecDraw
L_VecDrawPaint
L_VecDrawRealize
L_VecDumpLoad
L_VecDumpLoadRaster
L_VecDumpLoadVector
L_VecDumpSave
L_VecDumpSaveRaster
L_VecDumpSaveVector
L_VecDuplicateObjectDescriptor
L_VecEmpty
L_VecEmptyGroup
L_VecEmptyLayer
L_VecEnumGroups
L_VecEnumLayers
L_VecEnumObjects
L_VecEnumObjectsInGroup
L_VecEnumObjectsInLayer
L_VecEnumObjectsRaw
L_VecEnumVertices
L_VecEvent
L_VecExplodeObject
L_VecFree
L_VecFreeGroup
L_VecFreeGroupA
L_VecFreeLayer
L_VecFreeLayerA
L_VecFreeObject
L_VecFreePolyPoint
L_VecGetActiveLayer
L_VecGetBackgroundColor
L_VecGetBindVerticesMode
L_VecGetCamera
L_VecGetDisplayOptions
L_VecGetEmfDpi
L_VecGetFontMapper
L_VecGetFontMapperA
L_VecGetGroup
L_VecGetGroupA
L_VecGetGroupByIndex
L_VecGetGroupByName
L_VecGetGroupByNameA
L_VecGetGroupCount
L_VecGetHitTest
L_VecGetHyperlink
L_VecGetHyperlinkA
L_VecGetHyperlinkCount
L_VecGetLayer
L_VecGetLayerA
L_VecGetLayerByIndex
L_VecGetLayerByName
L_VecGetLayerByNameA
L_VecGetLayerCount
L_VecGetLeadArc
L_VecGetLineAngle
L_VecGetLineQuadNum
L_VecGetLogBrush
L_VecGetLogPen
L_VecGetMarker
L_VecGetObject
L_VecGetObjectA
L_VecGetObjectAttributes
L_VecGetObjectAttributesA
L_VecGetObjectDescription
L_VecGetObjectDescriptionA
L_VecGetObjectParallelogram
L_VecGetObjectRect
L_VecGetObjectTooltip
L_VecGetObjectTooltipA
L_VecGetObjectViewContext
L_VecGetOrigin
L_VecGetPalette
L_VecGetPan
L_VecGetParallelogram
L_VecGetPolygonMode
L_VecGetRotation
L_VecGetScale
L_VecGetSize
L_VecGetTranslation
L_VecGetUnit
L_VecGetViewMode
L_VecGetViewport
L_VecGotoHyperlink
L_VecHideObject
L_VecHideObjectTooltip
L_VecHitTest
L_VecInit
L_VecInitObject
L_VecInvertColors
L_VecIs3D
L_VecIsDirtyTransformAndCamera
L_VecIsEmpty
L_VecIsLocked
L_VecIsObjectHidden
L_VecIsObjectInsideParallelogram
L_VecIsObjectInsideRect
L_VecIsObjectSelected
L_VecIsObjectValidForAdding
L_VecLineTo
L_VecLogicalToPhysical
L_VecMatrixCopy
L_VecMatrixIdentity
L_VecMatrixInverse
L_VecMatrixMulByPoint
L_VecMatrixMultiply
L_VecMatrixReset
L_VecMatrixRotation
L_VecMatrixScale
L_VecMatrixSet
L_VecMoveTo
L_VecObjectGetPolyPoint
L_VecPaint
L_VecPaintDC
L_VecPhysicalToLogical
L_VecPointAdd
L_VecPointCopy
L_VecPointCross
L_VecPointDot
L_VecPointFindAngle
L_VecPointIsEqual
L_VecPointMagnitude
L_VecPointMax
L_VecPointMin
L_VecPointNormalize
L_VecPointReset
L_VecPointSubtract
L_VecPolyBezier
L_VecPolydraw
L_VecPolyline
L_VecRealize
L_VecRemoveObjectViewContext
L_VecRenderDC
L_VecSelectObject
L_VecSetActiveLayer
L_VecSetBackgroundColor
L_VecSetBindVerticesMode
L_VecSetCamera
L_VecSetDisplayOptions
L_VecSetEventCallback
L_VecSetEventCallbackA
L_VecSetFontMapper
L_VecSetFontMapperA
L_VecSetGroup
L_VecSetGroupA
L_VecSetHitTest
L_VecSetHyperlink
L_VecSetHyperlinkA
L_VecSetLayer
L_VecSetLayerA
L_VecSetLocked
L_VecSetMarker
L_VecSetObject
L_VecSetObjectA
L_VecSetObjectAttributes
L_VecSetObjectAttributesA
L_VecSetObjectDescription
L_VecSetObjectDescriptionA
L_VecSetObjectTooltip
L_VecSetObjectTooltipA
L_VecSetObjectViewContext
L_VecSetOrigin
L_VecSetPalette
L_VecSetPan
L_VecSetParallelogram
L_VecSetPolygonMode
L_VecSetRotation
L_VecSetScale
L_VecSetTranslation
L_VecSetUnit
L_VecSetViewMode
L_VecSetViewport
L_VecShowObjectTooltip
L_VecShowObjectTooltipA
L_VecWriterAdd
L_VecWriterClose
L_VecWriterOpen
L_VecWriterReset
L_VecZoomRect
_LEAD_Load@0

Sections

.text
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SqliteCLibX86.dll
.dll windows:5 windows x86 arch:x86

4f3593c00649a201f6e6cae542ba2fa8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Wangju\wangju\CSharp\Exercise\SVN的东东\SEM平台软件\设备组件\SqliteC\SqliteCLib2008\Debug\x86\SqliteCLibX86.pdb

Imports

sqlite3

sqlite3_last_insert_rowid
sqlite3_get_table
sqlite3_exec
sqlite3_close
sqlite3_open
sqlite3_bind_parameter_index
sqlite3_bind_parameter_count
sqlite3_bind_parameter_name
sqlite3_bind_null
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_text
sqlite3_changes
sqlite3_reset
sqlite3_free_table
sqlite3_step
sqlite3_finalize
sqlite3_errmsg
sqlite3_column_type
sqlite3_column_decltype
sqlite3_column_name
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_double
sqlite3_column_int64
sqlite3_column_int
sqlite3_prepare_v2
sqlite3_get_autocommit
sqlite3_busy_timeout
sqlite3_column_text
sqlite3_column_count
sqlite3_vmprintf
sqlite3_mprintf
sqlite3_free

kernel32

WriteFile
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FileTimeToLocalFileTime
OpenEventA
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
EnumResourceLanguagesA
ConvertDefaultLocale
GetProcAddress
GetModuleHandleA
SetEnvironmentVariableA
CompareStringW
LoadLibraryExA
GetLocaleInfoA
GetCurrentThreadId
GetCurrentThread
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetDateFormatA
GetTimeFormatA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapReAlloc
HeapSize
HeapAlloc
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
SetConsoleCtrlHandler
FatalAppExitA
IsValidCodePage
GetACP
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
VirtualQuery
GetSystemInfo
VirtualAlloc
ExitThread
CreateThread
ExitProcess
Sleep
IsBadReadPtr
HeapValidate
GetCommandLineA
RtlUnwind
RaiseException
SetFileAttributesA
LocalFileTimeToFileTime
GetFileAttributesExA
GetFileSizeEx
LoadLibraryW
GetSystemDirectoryW
FindResourceExA
GetOEMCP
GetCPInfo
GetDiskFreeSpaceA
GetTempFileNameA
GetFileTime
SetFileTime
GetFileAttributesA
SystemTimeToFileTime
FileTimeToSystemTime
GetModuleHandleW
GetShortPathNameA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DeleteFileA
MoveFileA
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
lstrcmpA
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
GetHandleInformation
GetProfileIntA
VirtualProtect
lstrcmpW
GlobalFindAtomA
GetVersionExA
GetAtomNameA
GlobalGetAtomNameA
GlobalDeleteAtom
FreeResource
ResumeThread
GetThreadPriority
SetThreadPriority
GlobalFlags
InterlockedIncrement
GetCurrentDirectoryA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
LoadLibraryA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
MulDiv
GlobalFree
lstrlenW
CopyFileA
GlobalSize
GlobalUnlock
FormatMessageA
LocalFree
lstrlenA
GetLastError
SetLastError
GetCurrentProcessId
GlobalAddAtomA
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
CloseHandle
LoadResource
LockResource
SizeofResource
FindResourceA
CompareStringA
InterlockedExchange
GlobalLock
GlobalAlloc
FreeLibrary
OpenFileMappingA

user32

GetAsyncKeyState
ShowWindow
MoveWindow
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
SendDlgItemMessageA
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
WinHelpA
TrackPopupMenuEx
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
SetMenu
GetMenu
GetMessageTime
GetMessagePos
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
RegisterWindowMessageA
EndDialog
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
DestroyMenu
LoadAcceleratorsA
GetSysColor
OpenIcon
CloseWindow
LoadIconA
LoadCursorA
PostThreadMessageA
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
GetWindowContextHelpId
SetWindowContextHelpId
SendNotifyMessageA
GetForegroundWindow
SetForegroundWindow
ShowCaret
HideCaret
SetCaretPos
GetCaretPos
GetClipboardViewer
GetClipboardOwner
GetOpenClipboardWindow
OpenClipboard
SetClipboardViewer
ChangeClipboardChain
FlashWindow
WindowFromPoint
SetParent
IsChild
GetTopWindow
FindWindowExA
FindWindowA
ChildWindowFromPointEx
ChildWindowFromPoint
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
DlgDirSelectComboBoxExA
DlgDirSelectExA
DlgDirListComboBoxA
DlgDirListA
SetCapture
GetCapture
SetRectEmpty
GetActiveWindow
KillTimer
SetTimer
DrawCaption
DrawAnimatedRects
EnableScrollBar
RedrawWindow
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRgn
InvalidateRgn
InvalidateRect
GetUpdateRgn
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ScreenToClient
MapWindowPoints
GetClientRect
BringWindowToTop
GetWindowRgn
SetWindowRgn
ArrangeIconicWindows
IsZoomed
IsIconic
HiliteMenuItem
GetSystemMenu
DrawMenuBar
DragDetect
GetDesktopWindow
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
UnregisterClassA
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
LoadMenuIndirectA
LoadMenuA
ModifyMenuA
InsertMenuItemA
SetMenuItemInfoA
GetMenuItemInfoA
GetMenuDefaultItem
SetMenuDefaultItem
EnableMenuItem
CheckMenuItem
DeleteMenu
CreatePopupMenu
CreateMenu
ScrollDC
GrayStringA
GetTabbedTextExtentA
DrawTextExA
DrawTextA
DrawFocusRect
DrawFrameControl
DrawEdge
DrawStateA
DrawIcon
InvertRect
FrameRect
FillRect
ExcludeUpdateRgn
WindowFromDC
GetSysColorBrush
UnhookWindowsHookEx
RemoveMenu
IsMenu
GetMenuItemCount
GetSubMenu
GetMenuState
GetMenuStringA
AppendMenuA
InsertMenuA
GetMenuItemID
MessageBoxA
GetWindowLongA
GetParent
GetLastActivePopup
IsWindowEnabled
EnableWindow
GetWindowThreadProcessId
SetCursor
GetKeyState
CallNextHookEx
PeekMessageA
GetCursorPos
SetWindowsHookExA
ValidateRect
ReleaseCapture
GetClipboardFormatNameA
UnpackDDElParam
CharUpperA
DestroyIcon
TranslateAcceleratorA
ReuseDDElParam
GetMenuBarInfo
GetKeyNameTextA
MapVirtualKeyA
GetDialogBaseUnits
SetActiveWindow
GetMessageA
TranslateMessage
DispatchMessageA
GetMenuCheckMarkDimensions
LoadBitmapA
SetMenuItemBitmaps
GetFocus
TabbedTextOutA
PostMessageA
SendMessageA
IsWindow
MapDialogRect
PostQuitMessage
IsRectEmpty
PtInRect
SetRect
InflateRect
UnionRect
SubtractRect
DispatchMessageW
GetMessageW
IsWindowUnicode
MsgWaitForMultipleObjects
CreateCaret

gdi32

CreateHatchBrush
CreateBrushIndirect
CreatePatternBrush
CreateDIBPatternBrushPt
CreateFontIndirectA
CreateFontA
CreateBitmapIndirect
SetBitmapBits
GetBitmapBits
SetBitmapDimensionEx
GetBitmapDimensionEx
CreateCompatibleBitmap
CreateDiscardableBitmap
CreatePalette
CreateHalftonePalette
GetPaletteEntries
SetPaletteEntries
AnimatePalette
GetNearestPaletteIndex
ResizePalette
CreateRectRgn
CreateRectRgnIndirect
CreateEllipticRgn
CreateEllipticRgnIndirect
CreatePolygonRgn
CreatePolyPolygonRgn
CreateRoundRectRgn
PathToRegion
ExtCreateRegion
GetRegionData
SetRectRgn
CombineRgn
EqualRgn
OffsetRgn
GetRgnBox
PtInRegion
RectInRegion
CreateICA
CreateCompatibleDC
GetBrushOrgEx
SetBrushOrgEx
EnumObjects
SelectObject
GetNearestColor
RealizePalette
UpdateColors
GetBkColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetMapMode
GetGraphicsMode
GetWorldTransform
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
FillRgn
FrameRgn
InvertRgn
PaintRgn
PtVisible
RectVisible
GetCurrentPositionEx
Arc
Polyline
Chord
Ellipse
Pie
Polygon
PolyPolygon
Rectangle
RoundRect
PatBlt
BitBlt
StretchBlt
GetPixel
SetPixel
FloodFill
ExtFloodFill
TextOutA
GetTextExtentPoint32A
GetTextAlign
GetTextFaceA
GetTextMetricsA
GetTextCharacterExtra
GetCharWidthA
CreatePenIndirect
CreateSolidBrush
GetAspectRatioFilterEx
Escape
SetBoundsRect
GetBoundsRect
ResetDCA
GetOutlineTextMetricsA
GetCharABCWidthsA
GetFontData
GetKerningPairsA
GetGlyphOutlineA
StartDocA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
MaskBlt
PlgBlt
SetPixelV
AngleArc
GetArcDirection
PolyPolyline
GetColorAdjustment
GetCurrentObject
PolyBezier
DrawEscape
ExtEscape
GetCharABCWidthsFloatA
GetCharWidthFloatA
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetMiterLimit
GetPath
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
GdiComment
PlayEnhMetaFile
DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectPalette
SetBkColor
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
EnumMetaFile
PlayMetaFile
GetDCOrgEx
StretchDIBits
EnumFontFamiliesExA
GetCharacterPlacementA
ExtCreatePen
CreatePen
GetObjectType
UnrealizeObject
CreateMetaFileA
CloseMetaFile
CreateEnhMetaFileA
CloseEnhMetaFile
ExtTextOutA
CreateBitmap
CopyMetaFileA
CreateDCA
GetDeviceCaps
GetObjectA
GetFontLanguageInfo
GetStockObject

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

SetFileSecurityA
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
OpenThreadToken
RevertToSelf
SetThreadToken
RegCreateKeyExA
RegSetValueA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetFileSecurityA

shell32

SHGetFileInfoA
ExtractIconA
DragFinish
DragQueryFileA
DragAcceptFiles

shlwapi

PathFindExtensionA
PathRemoveExtensionA
PathRemoveFileSpecW
PathIsUNCA
PathFindFileNameA
PathStripToRootA

ole32

CLSIDFromProgID
CLSIDFromString
StringFromGUID2
CoDisconnectObject
CoUninitialize
CoInitializeEx
CoCreateInstance
ReleaseStgMedium
CoTaskMemAlloc
OleRun
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CreateBindCtx
CoTaskMemFree
OleDuplicateData
CoRegisterClassObject
CoRevokeClassObject
CoTreatAsClass
CreateStreamOnHGlobal
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface

oleaut32

SafeArrayCopy
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayAllocDescriptor
SafeArrayAllocData
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VarBstrFromDec
VarDecFromStr
VarDateFromStr
VarBstrFromDate
SysAllocString
SafeArrayCreate
VariantCopy
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
SysStringLen
RegisterTypeLi
SafeArrayGetElemsize
SafeArrayGetDim
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
SysStringByteLen
SysAllocStringByteLen
DosDateTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
VarDateFromUdate
SystemTimeToVariantTime

Exports

Exports

AppendStringBuffer
CloseSqliteDB
CopyStringToBuffer
DeleteSqliteDBInstance
DeleteStringBuffer
ExecuteNonQuery
ExecuteQuery
ExecuteScalar
GetSqliteDBInstance
GetStringLength
GetStringPointer
OpenSqliteDB
SetErrorCallback
SetLogCallback

Sections

.textbss
Size: - Virtual size: 683KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 1024B - Virtual size: 793B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
_6576B57AEF624E0C61447A0675F18EC5
.dll regsvr32 windows:4 windows x86 arch:x86

545214bcc6b914f8693a73ed38504318

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdiplus

GdiplusShutdown
GdipGetImageEncodersSize
GdipCloneImage
GdipDisposeImage
GdipFree
GdipGetImageEncoders
GdiplusStartup
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipSaveImageToStream

mfc42

ord2863
ord2438
ord1644
ord1146
ord3984
ord5440
ord6383
ord283
ord3626
ord3706
ord2414
ord939
ord941
ord860
ord5856
ord2784
ord4278
ord2754
ord6170
ord5875
ord5789
ord6186
ord6192
ord6021
ord640
ord1640
ord323
ord537
ord2393
ord535
ord4025
ord996
ord5597
ord5710
ord926
ord2795
ord2062
ord2761
ord2528
ord5573
ord5450
ord6394
ord4224
ord2411
ord2023
ord4218
ord6055
ord4078
ord1776
ord4398
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3582
ord567
ord616
ord4275
ord2859
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord6052
ord1775
ord4407
ord5287
ord4835
ord4425
ord768
ord491
ord1907
ord489
ord4258
ord6241
ord4710
ord3721
ord795
ord613
ord289
ord3571
ord755
ord6194
ord6189
ord4023
ord5785
ord4330
ord470
ord3719
ord3610
ord2575
ord4396
ord3402
ord3574
ord4376
ord5280
ord3597
ord793
ord656
ord324
ord2358
ord2301
ord2297
ord2363
ord2302
ord4234
ord4284
ord6199
ord3092
ord2864
ord2642
ord4853
ord3874
ord2513
ord293
ord6334
ord3019
ord2516
ord361
ord1908
ord4715
ord1690
ord5288
ord4439
ord2054
ord4431
ord771
ord497
ord1008
ord4259
ord2367
ord6028
ord2737
ord5981
ord3873
ord2362
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord692
ord2339
ord2298
ord698
ord3619
ord2405
ord4187
ord5592
ord3437
ord5818
ord3645
ord396
ord911
ord5630
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord4622
ord3670
ord561
ord815
ord4317
ord2724
ord6354
ord1216
ord6467
ord1227
ord1877
ord4006
ord6270
ord2730
ord2729
ord4249
ord2486
ord6042
ord3230
ord5959
ord3119
ord5880
ord2911
ord5868
ord2901
ord5492
ord3457
ord2687
ord6364
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord5823
ord3664
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord1131
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord2384
ord6370
ord2983
ord3148
ord3260
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord3711
ord783
ord723
ord6262
ord6004
ord3946
ord415
ord423
ord715
ord3556
ord2714
ord1200
ord6281
ord5334
ord5314
ord5328
ord2541
ord4949
ord6605
ord4760
ord5888
ord4765
ord4756
ord4788
ord2112
ord4459
ord5767
ord3753
ord5033
ord4299
ord6128
ord2379
ord2652
ord1669
ord6030
ord1979
ord1969
ord665
ord603
ord273
ord5186
ord354
ord4743
ord1601
ord2452
ord6289
ord539
ord1770
ord467
ord968
ord3832
ord3315
ord452
ord1892
ord4252
ord3326
ord6365
ord1212
ord4570
ord4672
ord4843
ord5011
ord4713
ord6371
ord5286
ord4438
ord3279
ord4625
ord746
ord5992
ord449
ord2278
ord3506
ord3074
ord3111
ord3067
ord482
ord2526
ord469
ord6215
ord5953
ord1175
ord2246
ord2578
ord3797
ord4200
ord5768
ord6129
ord3752
ord3754
ord3756
ord4476
ord3317
ord2713
ord5794
ord6880
ord2086
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord6883
ord5608
ord2065
ord801
ord541
ord5604
ord5859
ord2818
ord4160
ord922
ord713
ord414
ord6141
ord3662
ord5821
ord2801
ord3654
ord2584
ord4220
ord2514
ord609
ord641
ord1168
ord2860
ord1641
ord472
ord5788
ord5787
ord4297
ord4133
ord3693
ord2727
ord3573
ord882
ord2740
ord879
ord2614
ord825
ord540
ord3663
ord6571
ord1871
ord823
ord2763
ord4129
ord858
ord800
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord1132
ord3952
ord4856

msvcrt

_mbscmp
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
strtod
memmove
ceil
_CIpow
_mbsicmp
_mbsrchr
free
_ftol
__CxxFrameHandler
wcscmp
malloc
_purecall
rand
??1type_info@@UAE@XZ

kernel32

LocalFree
Sleep
lstrcmpA
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
GetModuleFileNameA
lstrlenA
LoadLibraryA
GetUserDefaultLCID
FreeLibrary
GetSystemDefaultLCID
lstrcpynA
MulDiv
LocalAlloc

user32

SetTimer
SetCursor
OffsetRect
IntersectRect
SetRect
CopyRect
LoadMenuA
GetSubMenu
GetDoubleClickTime
DeleteMenu
InvalidateRect
EqualRect
PtInRect
LoadCursorA
IsRectEmpty
InflateRect
SetRectEmpty
KillTimer
ScreenToClient
SendMessageA
FillRect
GetClientRect
IsWindow
GetDlgItem
EnableWindow
GetDC
ReleaseCapture
SetCapture
GetSysColorBrush
ShowScrollBar
DestroyCursor
ReleaseDC
PeekMessageA
GetCursorPos
SetScrollPos
GetScrollPos
UpdateWindow
GetSystemMetrics
SetScrollRange
GetWindowRect
GetSysColor
UnionRect
MessageBeep
GetMenuItemCount
MessageBoxA

gdi32

Polygon
PtInRegion
CreatePolygonRgn
Pie
CreateEllipticRgnIndirect
Arc
Chord
OffsetRgn
CombineRgn
ExtTextOutA
GetTextExtentPoint32A
GetDeviceCaps
CreateICA
CreateSolidBrush
SelectObject
DPtoLP
PatBlt
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
GetTextMetricsA
CreateDCA
CreateFontIndirectA
RectVisible
CreateBitmap
DeleteDC
AbortDoc
EndDoc
EndPage
StartPage
StartDocA
SetAbortProc
GetCurrentObject
CreatePenIndirect
LPtoDP
Rectangle
CreateBrushIndirect

comdlg32

CommDlgExtendedError

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream

oleaut32

SafeArrayGetDim
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantClear
LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcp140_2.dll
.dll windows:6 windows x86 arch:x86

4197dfc91f80ec8c5a61d95036d29294

Code Sign

33:00:00:00:f7:80:de:c4:94:54:79:46:07:00:00:00:00:00:f7
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:43

Not After

16/10/2024, 19:43

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/05/2013, 20:44

Not After

01/05/2028, 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:8c:78:52:00:52:c6:9e:e0:74:8c:73:bc:19:57:a5:51:20:76:34:4e:e4:53:74:22:f3:a3:ba:00:3c:5b:c9
Signer

Actual PE Digest

1d:8c:78:52:00:52:c6:9e:e0:74:8c:73:bc:19:57:a5:51:20:76:34:4e:e4:53:74:22:f3:a3:ba:00:3c:5b:c9

Digest Algorithm

sha256

PE Digest Matches

true

1d:8c:78:52:00:52:c6:9e:e0:74:8c:73:bc:19:57:a5:51:20:76:34:4e:e4:53:74:22:f3:a3:ba:00:3c:5b:c9
Signer

Actual PE Digest

1d:8c:78:52:00:52:c6:9e:e0:74:8c:73:bc:19:57:a5:51:20:76:34:4e:e4:53:74:22:f3:a3:ba:00:3c:5b:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140_2.i386.pdb

Imports

msvcp140

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?widen@?$ctype@D@std@@QBEDD@Z
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?clear@ios_base@std@@QAEXH_N@Z
?rdstate@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?precision@ios_base@std@@QBE_JXZ
??1facet@locale@std@@MAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1ios_base@std@@UAE@XZ
?_Addstd@ios_base@std@@SAXPAV12@@Z
??0ios_base@std@@IAE@XZ
?_Init@ios_base@std@@IAEXXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
??0facet@locale@std@@IAE@I@Z
??Bid@locale@std@@QAEIXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
?width@ios_base@std@@QBE_JXZ
??0_Lockit@std@@QAE@H@Z

vcruntime140

__std_type_info_destroy_list
__std_terminate
_except_handler4_common
_CxxThrowException
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
memcmp
memset
memmove
memcpy
memchr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_errno
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_seh_filter_dll

api-ms-win-crt-math-l1-1-0

_ldclass
ceil
floor
_CIsqrt
_CIsinh
_CIsin
_fdclass
ldexp
_CIlog
_CIfmod
_CIexp
_CIcosh
_CIcos
_CIatan
_CIpow
frexp
_dclass
_CItan

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_callnewh
free

api-ms-win-crt-string-l1-1-0

strcspn

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-locale-l1-1-0

localeconv

kernel32

DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent

Exports

Exports

___std_smf_assoc_laguerre@16
___std_smf_assoc_laguerref@12
___std_smf_assoc_legendre@16
___std_smf_assoc_legendref@12
___std_smf_beta@16
___std_smf_betaf@8
___std_smf_comp_ellint_1@8
___std_smf_comp_ellint_1f@4
___std_smf_comp_ellint_2@8
___std_smf_comp_ellint_2f@4
___std_smf_comp_ellint_3@16
___std_smf_comp_ellint_3f@8
___std_smf_cyl_bessel_i@16
___std_smf_cyl_bessel_if@8
___std_smf_cyl_bessel_j@16
___std_smf_cyl_bessel_jf@8
___std_smf_cyl_bessel_k@16
___std_smf_cyl_bessel_kf@8
___std_smf_cyl_neumann@16
___std_smf_cyl_neumannf@8
___std_smf_ellint_1@16
___std_smf_ellint_1f@8
___std_smf_ellint_2@16
___std_smf_ellint_2f@8
___std_smf_ellint_3@24
___std_smf_ellint_3f@12
___std_smf_expint@8
___std_smf_expintf@4
___std_smf_hermite@12
___std_smf_hermitef@8
___std_smf_hypot3@24
___std_smf_hypot3f@12
___std_smf_laguerre@12
___std_smf_laguerref@8
___std_smf_legendre@12
___std_smf_legendref@8
___std_smf_riemann_zeta@8
___std_smf_riemann_zetaf@4
___std_smf_sph_bessel@12
___std_smf_sph_besself@8
___std_smf_sph_legendre@16
___std_smf_sph_legendref@12
___std_smf_sph_neumann@12
___std_smf_sph_neumannf@8

Sections

.text
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
taskmgr.exe
.exe windows:4 windows x86 arch:x86

e5cbcaa057aa52680139baf82e8d67a2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetThreadTimes
lstrcpyW
MultiByteToWideChar
GetPriorityClass
OpenProcess
SetProcessAffinityMask
GetProcessAffinityMask
VirtualAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
SetEvent
CreateEventW
lstrcmpW
DeleteCriticalSection
VirtualFree
FormatMessageW
lstrcmpiW
lstrlenW
SetPriorityClass
lstrcatW
GetCurrentProcess
GetModuleHandleW
GetCommandLineW
GetStartupInfoW
CreateMutexW
ExitProcess
InitializeCriticalSection
ReleaseMutex
CreateThread
SetProcessShutdownParameters
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
CloseHandle
GetCurrentDirectoryW
LocalFree
lstrcpynW
GetLastError
TerminateProcess
LocalAlloc
CreateProcessW

gdi32

CreateCompatibleBitmap
Rectangle
DeleteDC
BitBlt
CreateCompatibleDC
MoveToEx
SelectObject
CreatePen
LineTo
GetDeviceCaps
CreateRectRgn
GetStockObject
DeleteObject

user32

SetWindowPos
SendMessageW
MapWindowPoints
GetMenu
CheckMenuRadioItem
GetDlgItem
wsprintfW
GetAsyncKeyState
GetForegroundWindow
EnableMenuItem
SetMenu
LoadIconW
SetTimer
GetThreadDesktop
GetDialogBaseUnits
GetWindowRect
DefWindowProcW
EndPaint
DrawEdge
BeginPaint
IsIconic
SetWindowTextW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ShowWindow
GetShellWindow
DestroyIcon
LoadImageW
WinHelpW
KillTimer
DestroyWindow
SetForegroundWindow
OpenIcon
MessageBeep
GetSubMenu
MoveWindow
IsZoomed
PostThreadMessageW
PostQuitMessage
GetWindowPlacement
LoadAcceleratorsW
GetMessageW
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
CreateDialogParamW
DeleteMenu
CheckMenuItem
FindWindowW
EndDialog
IsDlgButtonChecked
CheckDlgButton
DestroyMenu
RemoveMenu
LoadMenuW
UpdateWindow
InvalidateRect
SetFocus
DialogBoxParamW
CharLowerBuffW
TrackPopupMenuEx
EnableWindow
SetMenuDefaultItem
EnumWindowStationsW
GetClassLongW
CloseWindowStation
SetProcessWindowStation
EnumDesktopsW
GetProcessWindowStation
OpenWindowStationW
CloseDesktop
EnumWindows
SetThreadDesktop
OpenDesktopW
IsWindowVisible
GetWindow
PostMessageW
GetWindowThreadProcessId
CascadeWindows
GetDesktopWindow
ShowWindowAsync
TileWindows
GetCursorPos
GetClassInfoW
RegisterClassW
GetKeyState
GetWindowLongW
SetWindowLongW
GetUpdateRgn
GetDCEx
GetClientRect
FillRect
ReleaseDC
SystemParametersInfoW
GetSystemMetrics
LoadStringW
MessageBoxW
SendMessageTimeoutW
GetDC
GetMenuItemInfoW
EndTask
InternalGetWindowText
IsHungAppWindow

advapi32

RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

comctl32

ord17
ImageList_Remove
CreateStatusWindowW
ImageList_Create
ImageList_ReplaceIcon

ntdll

NtOpenThread
NtClose
_wcsicmp
RtlTimeToElapsedTimeFields
strrchr
_allmul
_alldiv
memmove
NtQuerySystemInformation

vdmdbg

VDMEnumTaskWOWEx
VDMTerminateTaskWOW

shell32

ord61
ord100
Shell_NotifyIconW
ShellAboutW

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vccorlib140.dll
.dll windows:6 windows x86 arch:x86

e2c243eaa5d873a145fcef834080de02

Code Sign

33:00:00:00:f7:80:de:c4:94:54:79:46:07:00:00:00:00:00:f7
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:43

Not After

16/10/2024, 19:43

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/05/2013, 20:44

Not After

01/05/2028, 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:c6:7a:b5:45:eb:06:2b:9c:d5:57:9e:4f:d8:45:4d:d9:4d:c1:68:b6:42:0c:a3:11:a4:03:13:37:2a:a3:c7
Signer

Actual PE Digest

9b:c6:7a:b5:45:eb:06:2b:9c:d5:57:9e:4f:d8:45:4d:d9:4d:c1:68:b6:42:0c:a3:11:a4:03:13:37:2a:a3:c7

Digest Algorithm

sha256

PE Digest Matches

true

9b:c6:7a:b5:45:eb:06:2b:9c:d5:57:9e:4f:d8:45:4d:d9:4d:c1:68:b6:42:0c:a3:11:a4:03:13:37:2a:a3:c7
Signer

Actual PE Digest

9b:c6:7a:b5:45:eb:06:2b:9c:d5:57:9e:4f:d8:45:4d:d9:4d:c1:68:b6:42:0c:a3:11:a4:03:13:37:2a:a3:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\x86ret\bin\i386\vccorlib140.i386.pdb

Imports

kernel32

RaiseException
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageW
GetProcAddress
LoadLibraryExW
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetLastError
OutputDebugStringW
HeapAlloc
DeleteCriticalSection
GetProcessHeap
CreateEventExW
WaitForMultipleObjectsEx
SetEvent
CloseHandle
DecodePointer
InitializeSRWLock
TryAcquireSRWLockShared
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead

vcruntime140

__std_type_info_destroy_list
memcpy
_except_handler4_common
_CxxThrowException
__current_exception_context
__current_exception
memmove
memset
_SetWinRTOutOfMemoryExceptionCallback
__GetPlatformExceptionInfo
__std_exception_copy
__std_exception_destroy
__std_terminate
_purecall
__CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_invalid_parameter_noinfo_noreturn
_invoke_watson
__p___wargv
__p___argc
_configure_wide_argv
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_initterm_e
_initterm
_cexit

api-ms-win-crt-heap-l1-1-0

_aligned_offset_malloc
free
_callnewh
malloc
_aligned_free

api-ms-win-crt-string-l1-1-0

wcscpy_s

msvcp140

?_Xlength_error@std@@YAXPBD@Z

ole32

CoTaskMemAlloc
CoGetApartmentType
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoAddRefServerProcess
CoGetContextToken
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoReleaseServerProcess

oleaut32

SysAllocStringLen
SysFreeString

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsGetStringLen
WindowsCreateString
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoTransformError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoRegisterForApartmentShutdown
RoRegisterActivationFactories
RoUnregisterForApartmentShutdown
RoRevokeActivationFactories
RoGetApartmentIdentifier
RoInitialize

api-ms-win-crt-math-l1-1-0

ceil

Exports

Exports

?<Dispose>@Exception@Platform@@U$AAAXXZ
?<Dispose>@String@Platform@@U$AAAXXZ
?<Dispose>@Type@Platform@@U$AAAXXZ
??0AccessDeniedException@Platform@@Q$AAA@P$AAVString@1@@Z
??0AccessDeniedException@Platform@@Q$AAA@XZ
??0Attribute@Metadata@Platform@@Q$AAA@XZ
??0Boolean@Platform@@QAA@_N@Z
??0COMException@Platform@@Q$AAA@H@Z
??0COMException@Platform@@Q$AAA@HP$AAVString@1@@Z
??0ChangedStateException@Platform@@Q$AAA@P$AAVString@1@@Z
??0ChangedStateException@Platform@@Q$AAA@XZ
??0ClassNotRegisteredException@Platform@@Q$AAA@P$AAVString@1@@Z
??0ClassNotRegisteredException@Platform@@Q$AAA@XZ
??0Delegate@Platform@@Q$AAA@XZ
??0DisconnectedException@Platform@@Q$AAA@P$AAVString@1@@Z
??0DisconnectedException@Platform@@Q$AAA@XZ
??0Enum@Platform@@Q$AAA@XZ
??0Exception@Platform@@Q$AAA@H@Z
??0Exception@Platform@@Q$AAA@HP$AAVString@1@@Z
??0FailureException@Platform@@Q$AAA@P$AAVString@1@@Z
??0FailureException@Platform@@Q$AAA@XZ
??0GridLength@Xaml@UI@Windows@@QAA@NW4GridUnitType@123@@Z
??0IntPtr@Platform@@QAA@H@Z
??0IntPtr@Platform@@QAA@PAX@Z
??0InvalidArgumentException@Platform@@Q$AAA@P$AAVString@1@@Z
??0InvalidArgumentException@Platform@@Q$AAA@XZ
??0InvalidCastException@Platform@@Q$AAA@P$AAVString@1@@Z
??0InvalidCastException@Platform@@Q$AAA@XZ
??0MTAThreadAttribute@Platform@@Q$AAA@XZ
??0NotImplementedException@Platform@@Q$AAA@P$AAVString@1@@Z
??0NotImplementedException@Platform@@Q$AAA@XZ
??0NullReferenceException@Platform@@Q$AAA@P$AAVString@1@@Z
??0NullReferenceException@Platform@@Q$AAA@XZ
??0Object@Platform@@Q$AAA@XZ
??0ObjectDisposedException@Platform@@Q$AAA@P$AAVString@1@@Z
??0ObjectDisposedException@Platform@@Q$AAA@XZ
??0OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@Q$AAA@XZ
??0OperationCanceledException@Platform@@Q$AAA@P$AAVString@1@@Z
??0OperationCanceledException@Platform@@Q$AAA@XZ
??0OutOfBoundsException@Platform@@Q$AAA@P$AAVString@1@@Z
??0OutOfBoundsException@Platform@@Q$AAA@XZ
??0OutOfMemoryException@Platform@@Q$AAA@P$AAVString@1@@Z
??0OutOfMemoryException@Platform@@Q$AAA@XZ
??0Rect@Foundation@Windows@@QAA@VPoint@12@0@Z
??0Rect@Foundation@Windows@@QAA@VPoint@12@VSize@12@@Z
??0RepeatBehavior@Animation@Media@Xaml@UI@Windows@@QAA@N@Z
??0STAThreadAttribute@Platform@@Q$AAA@XZ
??0SizeT@Platform@@QAA@H@Z
??0SizeT@Platform@@QAA@PAX@Z
??0Type@Platform@@Q$AAA@P$AAVObject@1@@Z
??0Type@Platform@@Q$AAA@VIntPtr@1@@Z
??0Type@Platform@@Q$AAA@VTypeName@Interop@Xaml@UI@Windows@@@Z
??0ValueType@Platform@@Q$AAA@XZ
??0WrongThreadException@Platform@@Q$AAA@P$AAVString@1@@Z
??0WrongThreadException@Platform@@Q$AAA@XZ
??0char16@default@@QAA@_W@Z
??0float32@default@@QAA@M@Z
??0float64@default@@QAA@N@Z
??0int16@default@@QAA@F@Z
??0int32@default@@QAA@H@Z
??0int64@default@@QAA@_J@Z
??0int8@default@@QAA@C@Z
??0uint16@default@@QAA@G@Z
??0uint32@default@@QAA@I@Z
??0uint64@default@@QAA@_K@Z
??0uint8@default@@QAA@E@Z
??BIntPtr@Platform@@SA?AV01@H@Z
??BIntPtr@Platform@@SA?AV01@PAX@Z
??BIntPtr@Platform@@SAPAXV01@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@P$AAV01@@Z
??BType@Platform@@SAP$AAV01@VTypeName@Interop@Xaml@UI@Windows@@@Z
??DMatrix3D@Media3D@Media@Xaml@UI@Windows@@SA?AV012345@V012345@0@Z
??GDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??HDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??MDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??NDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??ODuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??PDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
?AlignedAllocate@Heap@Details@Platform@@SAPAXII@Z
?AlignedAllocate@Heap@Details@Platform@@SAPAXIII@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPAXII@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPAXIII@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?AlignedFreeException@Heap@Details@Platform@@SAXPAX@Z
?Allocate@Heap@Details@Platform@@SAPAXI@Z
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?AllocateException@Heap@Details@Platform@@SAPAXI@Z
?AllocateException@Heap@Details@Platform@@SAPAXII@Z
?Compare@Duration@Xaml@UI@Windows@@SAHV1234@0@Z
?Contains@Rect@Foundation@Windows@@QAA_NVPoint@23@@Z
?CreateException@Exception@Platform@@SAP$AAV12@H@Z
?CreateException@Exception@Platform@@SAP$AAV12@HP$AAVString@2@@Z
?CreateValue@Details@Platform@@YGP$AAVObject@2@W4TypeCode@2@PBX@Z
?EnableFactoryCache@@YAXXZ
?EnumerateAllocatedObjects@Heap@Details@Platform@@SAXP$AAVHeapEntryHandler@23@@Z
?Equals@Attribute@Metadata@Platform@@Q$AAA_NP$AAVObject@3@@Z
?Equals@Boolean@Platform@@QAA_NP$AAVObject@2@@Z
?Equals@Delegate@Platform@@Q$AAA_NP$AAVObject@2@@Z
?Equals@Enum@Platform@@Q$AAA_NP$AAVObject@2@@Z
?Equals@Exception@Platform@@U$AAA_NP$AAVObject@2@@Z
?Equals@MTAThreadAttribute@Platform@@Q$AAA_NP$AAVObject@2@@Z
?Equals@Object@Platform@@Q$AAA_NP$AAV12@@Z
?Equals@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@Q$AAA_NP$AAVObject@4@@Z
?Equals@STAThreadAttribute@Platform@@Q$AAA_NP$AAVObject@2@@Z
?Equals@Type@Platform@@U$AAA_NP$AAVObject@2@@Z
?Equals@ValueType@Platform@@Q$AAA_NP$AAVObject@2@@Z
?Equals@char16@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@float32@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@float64@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@int16@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@int32@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@int64@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@int8@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@uint16@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@uint32@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@uint64@default@@QAA_NP$AAVObject@Platform@@@Z
?Equals@uint8@default@@QAA_NP$AAVObject@Platform@@@Z
?EventSourceAdd@Details@Platform@@YG?AVEventRegistrationToken@Foundation@Windows@@PAPAXPAUEventLock@12@P$AAVDelegate@2@@Z
?EventSourceGetTargetArray@Details@Platform@@YGPAXPAXPAUEventLock@12@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YGPAXPAXIPBXPA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YGIPAX@Z
?EventSourceInitialize@Details@Platform@@YGXPAPAX@Z
?EventSourceRemove@Details@Platform@@YGXPAPAXPAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceUninitialize@Details@Platform@@YGXPAPAX@Z
?FlushFactoryCache@@YGXXZ
?Free@Heap@Details@Platform@@SAXPAX@Z
?FreeException@Heap@Details@Platform@@SAXPAX@Z
?GetActivationFactory@Details@Platform@@YGJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z
?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z
?GetCmdArguments@Details@Platform@@YAPAPA_WPAH@Z
?GetHashCode@Attribute@Metadata@Platform@@Q$AAAHXZ
?GetHashCode@Boolean@Platform@@QAAHXZ
?GetHashCode@Delegate@Platform@@Q$AAAHXZ
?GetHashCode@Enum@Platform@@Q$AAAHXZ
?GetHashCode@Exception@Platform@@U$AAAHXZ
?GetHashCode@Guid@Platform@@QAAHXZ
?GetHashCode@MTAThreadAttribute@Platform@@Q$AAAHXZ
?GetHashCode@Object@Platform@@Q$AAAHXZ
?GetHashCode@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@Q$AAAHXZ
?GetHashCode@STAThreadAttribute@Platform@@Q$AAAHXZ
?GetHashCode@Type@Platform@@U$AAAHXZ
?GetHashCode@ValueType@Platform@@Q$AAAHXZ
?GetHashCode@char16@default@@QAAHXZ
?GetHashCode@float32@default@@QAAHXZ
?GetHashCode@float64@default@@QAAHXZ
?GetHashCode@int16@default@@QAAHXZ
?GetHashCode@int32@default@@QAAHXZ
?GetHashCode@int64@default@@QAAHXZ
?GetHashCode@int8@default@@QAAHXZ
?GetHashCode@uint16@default@@QAAHXZ
?GetHashCode@uint32@default@@QAAHXZ
?GetHashCode@uint64@default@@QAAHXZ
?GetHashCode@uint8@default@@QAAHXZ
?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z
?GetIBoxVtable@Details@Platform@@YGPAXPAX@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?GetObjectContext@Details@Platform@@YGPAUIUnknown@@XZ
?GetProxyImpl@Details@Platform@@YGJPAUIUnknown@@ABU_GUID@@0PAPAU3@@Z
?GetType@Boolean@Platform@@QAAP$AAVType@2@XZ
?GetType@Guid@Platform@@QAAP$AAVType@2@XZ
?GetType@Object@Platform@@Q$AAAP$AAVType@2@XZ
?GetType@char16@default@@QAAP$AAVType@Platform@@XZ
?GetType@float32@default@@QAAP$AAVType@Platform@@XZ
?GetType@float64@default@@QAAP$AAVType@Platform@@XZ
?GetType@int16@default@@QAAP$AAVType@Platform@@XZ
?GetType@int32@default@@QAAP$AAVType@Platform@@XZ
?GetType@int64@default@@QAAP$AAVType@Platform@@XZ
?GetType@int8@default@@QAAP$AAVType@Platform@@XZ
?GetType@uint16@default@@QAAP$AAVType@Platform@@XZ
?GetType@uint32@default@@QAAP$AAVType@Platform@@XZ
?GetType@uint64@default@@QAAP$AAVType@Platform@@XZ
?GetType@uint8@default@@QAAP$AAVType@Platform@@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@P$AAV12@@Z
?GetWeakReference@Details@Platform@@YGPAU__abi_IUnknown@@Q$ADVObject@2@@Z
?InitControlBlock@ControlBlock@Details@Platform@@AAEXPAX_N11@Z
?InitializeData@Details@Platform@@YAJH@Z
?Intersect@Rect@Foundation@Windows@@QAAXV123@@Z
?IntersectsWith@Rect@Foundation@Windows@@QAA_NV123@@Z
?Invert@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QAAXXZ
?ReCreateException@Exception@Platform@@SAP$AAV12@H@Z
?ReferenceEquals@Object@Platform@@SA_NP$AAV12@0@Z
?ReferenceEquals@Object@Platform@@SA_NP$AAVString@2@0@Z
?RegisterFactories@Details@Platform@@YGP$AAVObject@2@PAPAVModuleBase@1WRL@Microsoft@@PAPAU__abi_Module@@P6GXXZ@Z
?ReleaseInContextImpl@Details@Platform@@YGJPAUIUnknown@@0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?ResolveWeakReference@Details@Platform@@YGP$AAVObject@2@ABU_GUID@@PAPAU__abi_IUnknown@@@Z
?RunApplicationServer@Details@Platform@@YGXPAPAVModuleBase@1WRL@Microsoft@@PAPAU__abi_Module@@PB_W@Z
?RunServer@Details@Platform@@YGXPAPAVModuleBase@1WRL@Microsoft@@PAPAU__abi_Module@@PB_W@Z
?TerminateModule@Details@Platform@@YG_NPAVModuleBase@1WRL@Microsoft@@@Z
?ToInt32@IntPtr@Platform@@QAAHXZ
?ToString@Attribute@Metadata@Platform@@Q$AAAP$AAVString@3@XZ
?ToString@Boolean@Platform@@QAAP$AAVString@2@XZ
?ToString@Delegate@Platform@@Q$AAAP$AAVString@2@XZ
?ToString@Enum@Platform@@Q$AAAP$AAVString@2@XZ
?ToString@Exception@Platform@@U$AAAP$AAVString@2@XZ
?ToString@Guid@Platform@@QAAP$AAVString@2@XZ
?ToString@MTAThreadAttribute@Platform@@Q$AAAP$AAVString@2@XZ
?ToString@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@Q$AAAP$AAVString@4@XZ
?ToString@STAThreadAttribute@Platform@@Q$AAAP$AAVString@2@XZ
?ToString@Type@Platform@@U$AAAP$AAVString@2@XZ
?ToString@ValueType@Platform@@Q$AAAP$AAVString@2@XZ
?ToString@char16@default@@QAAP$AAVString@Platform@@XZ
?ToString@float32@default@@QAAP$AAVString@Platform@@XZ
?ToString@float64@default@@QAAP$AAVString@Platform@@XZ
?ToString@int16@default@@QAAP$AAVString@Platform@@XZ
?ToString@int32@default@@QAAP$AAVString@Platform@@XZ
?ToString@int64@default@@QAAP$AAVString@Platform@@XZ
?ToString@int8@default@@QAAP$AAVString@Platform@@XZ
?ToString@uint16@default@@QAAP$AAVString@Platform@@XZ
?ToString@uint32@default@@QAAP$AAVString@Platform@@XZ
?ToString@uint64@default@@QAAP$AAVString@Platform@@XZ
?ToString@uint8@default@@QAAP$AAVString@Platform@@XZ
?UninitializeData@Details@Platform@@YAXH@Z
?Union@Rect@Foundation@Windows@@QAAXV123@@Z
?Union@Rect@Foundation@Windows@@QAAXVPoint@23@@Z
?WriteLine@Console@Details@Platform@@SAXP$AAVObject@3@@Z
?WriteLine@Console@Details@Platform@@SAXP$AAVString@3@@Z
?WriteLine@Console@Details@Platform@@SAXXZ
?__abi_FailFast@@YGXXZ
?__abi_ObjectToString@__abi_details@@YGP$AAVString@Platform@@P$AAVObject@3@_N@Z
?__abi_Resolve@ControlBlock@Details@Platform@@UAGJAAVGuid@3@PAPAU__abi_IInspectable@@@Z
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_cast_Object_to_String@__abi_details@@YGP$AAVString@Platform@@_NP$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
?__abi_make_type_id@@YGP$AAVType@Platform@@ABU__abi_type_descriptor@@@Z
?__abi_translateCurrentException@@YGJ_N@Z
?__getActivationFactoryByHSTRING@@YGJPAUHSTRING__@@AAVGuid@Platform@@PAPAX@Z
?get@Bottom@Rect@Foundation@Windows@@QAAMXZ
?get@BreakOnAllocationId@Heap@Details@Platform@@SAHXZ
?get@BreakOnFreeId@Heap@Details@Platform@@SAHXZ
?get@CurrentAllocationId@Heap@Details@Platform@@SAHXZ
?get@Empty@Rect@Foundation@Windows@@SA?AV234@XZ
?get@Empty@Size@Foundation@Windows@@SA?AV234@XZ
?get@FullName@Type@Platform@@Q$AAAP$AAVString@3@XZ
?get@HasInverse@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QAA_NXZ
?get@Message@Exception@Platform@@Q$AAAP$AAVString@3@XZ
?get@ObjectCount@Heap@Details@Platform@@SAHXZ
?get@Right@Rect@Foundation@Windows@@QAAMXZ
?get@TrackingLevel@Heap@Details@Platform@@SA?AW4HeapAllocationTrackingLevel@34@XZ
?set@BreakOnAllocationId@Heap@Details@Platform@@SAXH@Z
?set@BreakOnFreeId@Heap@Details@Platform@@SAXH@Z
?set@TrackingLevel@Heap@Details@Platform@@SAXW4HeapAllocationTrackingLevel@34@@Z

Sections

.text
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vcruntime140_threads.dll
.dll windows:6 windows x86 arch:x86

e8edb7c7e9e02baa5e491360be7c4257

Code Sign

33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:43

Not After

16/10/2024, 19:43

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/05/2013, 20:44

Not After

01/05/2028, 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:f1:60:68:5f:6c:f5:2a:32:a1:de:d2:77:1d:5f:3b:0b:16:fe:10:84:bd:6e:4f:ff:27:2a:24:34:de:ae:a0
Signer

Actual PE Digest

56:f1:60:68:5f:6c:f5:2a:32:a1:de:d2:77:1d:5f:3b:0b:16:fe:10:84:bd:6e:4f:ff:27:2a:24:34:de:ae:a0

Digest Algorithm

sha256

PE Digest Matches

true

56:f1:60:68:5f:6c:f5:2a:32:a1:de:d2:77:1d:5f:3b:0b:16:fe:10:84:bd:6e:4f:ff:27:2a:24:34:de:ae:a0
Signer

Actual PE Digest

56:f1:60:68:5f:6c:f5:2a:32:a1:de:d2:77:1d:5f:3b:0b:16:fe:10:84:bd:6e:4f:ff:27:2a:24:34:de:ae:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140_threads.i386.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_cexit
abort
_beginthreadex
_errno

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free

api-ms-win-crt-time-l1-1-0

_timespec64_get
_timespec32_get

vcruntime140

_except_handler4_common
memset
__std_type_info_destroy_list
__CxxFrameHandler3

kernel32

ReleaseSRWLockExclusive
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetExitCodeThread
ExitThread
GetCurrentThreadId
SwitchToThread
Sleep
WaitForSingleObject
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
AcquireSRWLockShared
CloseHandle
GetLastError
ReleaseSRWLockShared
AcquireSRWLockExclusive

Exports

Exports

_cnd_timedwait32
_cnd_timedwait64
_mtx_timedlock32
_mtx_timedlock64
_thrd_sleep32
_thrd_sleep64
call_once
cnd_broadcast
cnd_destroy
cnd_init
cnd_signal
cnd_wait
mtx_destroy
mtx_init
mtx_lock
mtx_trylock
mtx_unlock
thrd_create
thrd_current
thrd_detach
thrd_equal
thrd_exit
thrd_join
thrd_yield
tss_create
tss_delete
tss_get
tss_set

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a7be52633b01426b17d148203c82793

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

user32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 885KB - Virtual size: 885KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 1KB - Virtual size: 34KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 95KB - Virtual size: 94KB

.reloc Size: 36KB - Virtual size: 36KB

a8289ce4186d91574885fecdb6300d4d

Code Sign

04:44:c0Certificate

Key Usages

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

2f:4c:a9:11:3e:5b:72:b9:ba:3e:68:ad:3a:a7:9a:6fCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

9e:63:a1:47:72:e5:c3:5d:29:60:75:d6:3c:00:e5:3c:75:7e:78:76:b3:0a:d6:70:29:08:2b:fc:25:65:0b:3fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc120u

msvcr120

kernel32

user32

advapi32

comctl32

oleaut32

urlmon

msvcp120

iphlpapi

wininet

Sections

.text Size: 219KB - Virtual size: 219KB

.rdata Size: 53KB - Virtual size: 52KB

.data Size: 2KB - Virtual size: 13KB

.rsrc Size: 70KB - Virtual size: 70KB

.reloc Size: 23KB - Virtual size: 22KB

2a1fb9631a46ba5cb1034aec8f44cdf7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:11:5f:ca:66:52:08:ed:5a:e6:32:36:96:ea:9c:20Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5b:5c:f5:8b:0a:ce:80:09:9a:ee:d1:9a:a4:89:c5:a2:85:0f:25:db:9c:e7:8e:79:b3:7e:f8:cf:db:96:4a:edSigner

Headers

.text
Size: 885KB - Virtual size: 885KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 1KB - Virtual size: 34KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 95KB - Virtual size: 94KB

.reloc
Size: 36KB - Virtual size: 36KB

04:44:c0
Certificate

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

2f:4c:a9:11:3e:5b:72:b9:ba:3e:68:ad:3a:a7:9a:6f
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

9e:63:a1:47:72:e5:c3:5d:29:60:75:d6:3c:00:e5:3c:75:7e:78:76:b3:0a:d6:70:29:08:2b:fc:25:65:0b:3f
Signer

.text
Size: 219KB - Virtual size: 219KB

.rdata
Size: 53KB - Virtual size: 52KB

.data
Size: 2KB - Virtual size: 13KB

.rsrc
Size: 70KB - Virtual size: 70KB

.reloc
Size: 23KB - Virtual size: 22KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:11:5f:ca:66:52:08:ed:5a:e6:32:36:96:ea:9c:20
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5b:5c:f5:8b:0a:ce:80:09:9a:ee:d1:9a:a4:89:c5:a2:85:0f:25:db:9c:e7:8e:79:b3:7e:f8:cf:db:96:4a:ed
Signer

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:11:5f:ca:66:52:08:ed:5a:e6:32:36:96:ea:9c:20
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6e:7c:55:68:1f:64:44:ff:79:e1:88:ec:7e:53:d4:35:fa:c2:19:27:73:38:02:b9:48:e2:75:cc:e8:5e:8b:f6
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.data:
Size: 733KB - Virtual size: 733KB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 144KB - Virtual size: 204KB

.rsrc
Size: 313KB - Virtual size: 312KB

.reloc
Size: 137KB - Virtual size: 136KB

07
Certificate