f4b32d247ffaff49cbc35f24453463c9fcbf78d721e8cc7225ea501c2f10eb63.zip
- SHA256 f4b32d247ffaff49cbc35f24453463c9fcbf78d721e8cc7225ea501c2f10eb63
Overview
overview
10Static
static
1HTCTL32.dll
windows7-x64
3HTCTL32.dll
windows10-2004-x64
3PCICHEK.dll
windows7-x64
1PCICHEK.dll
windows10-2004-x64
1PCICL32.dll
windows7-x64
1PCICL32.dll
windows10-2004-x64
1TCCTL32.dll
windows7-x64
1TCCTL32.dll
windows10-2004-x64
1client32.exe
windows7-x64
10client32.exe
windows10-2004-x64
10msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3new_chrome_proxy.exe
windows10-2004-x64
pcicapi.dll
windows7-x64
1pcicapi.dll
windows10-2004-x64
1remcmdstub.exe
windows7-x64
1remcmdstub.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
HTCTL32.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
HTCTL32.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
PCICHEK.dll
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
PCICHEK.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
PCICL32.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
PCICL32.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
TCCTL32.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
TCCTL32.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
client32.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
client32.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
msvcr100.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
msvcr100.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
new_chrome_proxy.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
pcicapi.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
pcicapi.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
remcmdstub.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
remcmdstub.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target f4b32d247ffaff49cbc35f24453463c9fcbf78d721e8cc7225ea501c2f10eb63.zip
- Size 3.3MB
- Sample240706-ce98kssenl
- SHA256 f4b32d247ffaff49cbc35f24453463c9fcbf78d721e8cc7225ea501c2f10eb63
- MD5 49da8738d79c3c97802fd08b46185891
- SHA1 746ceff8a4966ad42770ababf367957ee5cac035
- SHA512 ae455380fc4e940cacbdc3e28058ec7919c7c59ffbb934d6772a1f92475a10dccdf8c54524983293b0f6e8a6e274d07b77dbcb9ec0386822efb60eea9b71e9cb
- SSDEEP 98304:E1NFXa/hRFY89YYc9jh23redpmQRcQZrAiaOcgW:UNSxYoY59V0redpmQRcm3M
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
f4b32d247ffaff49cbc35f24453463c9fcbf78d721e8cc7225ea501c2f10eb63.zip.zip 3.3MB
-
HTCTL32.DLL.dll 320KB
-
NSM.LIC195B
-
NSM.ini6KB
-
PCICHEK.DLL.dll 18KB
-
PCICL32.DLL.dll 3.6MB
-
TCCTL32.DLL.dll 387KB
-
client32.exe.exe 101KB
-
client32.ini671B
-
install/02a7244d2ed058ed_02KB
-
install/1a7d70470ec607c8_01KB
-
install/24.4.4.1168.manifest223B
-
install/24.6.0.1874.manifest223B
-
install/2a9877b782e7616c_042KB
-
install/StartVoiceCapture.wav63KB
-
install/browser.VisualElementsManifest.xml585B
-
install/camera_mf_trace.wprp.xml 24KB
-
install/chrome.VisualElementsManifest.xml413B
-
install/config.cfg188B
-
install/cs.pak428KB
-
install/de.pak446KB
-
install/delegatedWebFeatures.sccd.xml 17KB
-
install/en-US.pak358KB
-
install/fr.pak463KB
-
install/manifest.json170B
-
install/mf_trace.wprp.xml 12KB
-
install/preloaded_data.pb8KB
-
install_state.json1KB
-
msvcr100.dll.dll 755KB
-
new_chrome_proxy.exe.exe 1.0MB
-
nskbfltr.inf328B
-
nsm_vpro.ini46B
-
pcicapi.dll.dll 32KB
-
remcmdstub.exe.exe 62KB
HTCTL32.DLL
- IMPHASH 6ba08298dd09ea8e41ab7285d3183bba
- SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- MD5 c94005d2dcd2a54e40510344e0bb9435
- SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP 6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
- MD5 SHA1 SHA512 SSDEEP
Digest
49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
1
Major OS version
5
Entry point
154342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb
wsock32
getpeername
ntohs
socket
setsockopt
bind
htons
WSASetBlockingHook
WSAUnhookBlockingHook
send
gethostname
getsockname
connect
__WSAFDIsSet
WSASetLastError
ioctlsocket
gethostbyname
shutdown
recv
closesocket
WSACancelBlockingCall
inet_ntoa
select
WSAGetLastError
WSAStartup
WSACleanup
inet_addr
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
kernel32
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetLocaleInfoW
LoadLibraryW
SetConsoleCtrlHandler
FatalAppExitA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
ReadFile
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDBCSLeadByte
CompareStringA
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
OutputDebugStringA
LoadLibraryA
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
SetLastError
WritePrivateProfileStringA
CloseHandle
FlushFileBuffers
SetFilePointer
GetFileSize
GetPrivateProfileIntA
CreateFileA
SetStdHandle
WriteFile
GetLocalTime
GetDateFormatA
CopyFileA
InterlockedExchange
SetEvent
GetVersionExA
InterlockedDecrement
GetTickCount
SystemTimeToFileTime
GetSystemTime
OpenProcess
GetCurrentProcessId
GetCurrentThreadId
InterlockedIncrement
GetTempPathA
ReleaseMutex
WaitForSingleObject
TerminateThread
lstrlenA
CreateMutexA
SetThreadPriority
CreateThread
CreateEventA
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetVersion
GlobalFree
LCMapStringW
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
HeapDestroy
HeapCreate
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetLastError
PulseEvent
HeapAlloc
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
EncodePointer
DecodePointer
GetCommandLineA
GetModuleHandleW
GetStdHandle
user32
PostThreadMessageA
PostMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
KillTimer
PeekMessageA
PostQuitMessage
GetDesktopWindow
MessageBoxA
wvsprintfA
wsprintfA
advapi32
GetTokenInformation
LogonUserA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
OpenProcessToken
ctl_adddomain
ctl_addoperator
ctl_bridgename
ctl_broadcast
ctl_broadcastdata
ctl_call
ctl_callremote
ctl_clearpin
ctl_clientpinrequest
ctl_clientstatus
ctl_close
ctl_closeremote
ctl_connected
ctl_controlpinrequest
ctl_controlsendpin
ctl_escape
ctl_findslaves
ctl_findslaves2
ctl_findslavesex
ctl_getconnectivityinfo
ctl_getfailedreason
ctl_getfileinfo
ctl_getlocalipaddressinuse
ctl_getsession
ctl_hangup
ctl_helpreq
ctl_installed
ctl_licenseinfo
ctl_maxpacket
ctl_messageacknowledged
ctl_messagereceived
ctl_myaddr
ctl_netname
ctl_networks
ctl_nsessions
ctl_open
ctl_openremote
ctl_pause
ctl_pingnet
ctl_pittmanfunc
ctl_publishservice
ctl_publishserviceex
ctl_putfile
ctl_putfilelink
ctl_remotename
ctl_removedomain
ctl_removeoperator
ctl_send
ctl_sendif
ctl_sendto
ctl_subset
ctl_userstatus
ctl_version
Name
.text
Size
249KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=155, id=1, productName=Unmarked objects,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=122, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
NSM.LIC
- SHA256 dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747
- MD5 e9609072de9c29dc1963be208948ba44
- SHA1 03bbe27d0d1ba651ff43363587d3d6d2e170060f
- SHA512 f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0
- MD5 SHA1 SHA512
NSM.ini
- SHA256 60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f92
- MD5 88b1dab8f4fd1ae879685995c90bd902
- SHA1 3d23fb4036dc17fa4bee27e3e2a56ff49beed59d
- SHA512 4ea2c20991189fe1d6d5c700603c038406303cca594577ddcbc16ab9a7915cb4d4aa9e53093747db164f068a7ba0f568424bc8cb7682f1a3fb17e4c9ec01f047
- SSDEEP 96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
- MD5 SHA1 SHA512 SSDEEP
PCICHEK.DLL
- IMPHASH 1233e02b30a7c416ba5aa017ff2ba312
- SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- MD5 104b30fef04433a2d2fd1d5f99f179fe
- SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP 192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
- MD5 SHA1 SHA512 SSDEEP
Digest
70:19:fe:86:36:c1:40:67:6b:d7:25:97:c0:51:e5:67:eb:67:bc:13:2b:d0:4d:e9:c0:a6:86:94:94:24:fd:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
31:07:46:8f:ed:21:e6:3d:07:54:56:b3:a3:48:b0:a4:21:17:45:d8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
1
Major OS version
5
Entry point
4256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb
kernel32
GetVersionExA
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ExitProcess
user32
LoadStringA
MessageBoxA
wsprintfA
msvcr100
_except_handler4_common
_crt_debugger_hook
memset
CheckLicenseString
IsILS
IsJPIK
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
946B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
490B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=152, version=20115,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=99, id=1, productName=Unmarked objects,
count=10, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
PCICL32.DLL
- IMPHASH 3e09384870fa6c1a29cc37553985fcc6
- SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- MD5 d3d39180e85700f72aaae25e40c125ff
- SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP 49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
- MD5 SHA1 SHA512 SSDEEP
Digest
39:f1:c3:8f:1a:d9:c2:ff:24:db:8c:82:7e:b1:d7:d8:ae:74:a1:1b:4d:42:a8:c3:5c:7f:74:30:be:67:e4:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
5b:48:76:9b:35:e3:29:03:10:0e:18:24:5a:d4:72:ec:84:25:12:32
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
1
Major OS version
5
Entry point
1484237
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb
secur32
GetUserNameExA
shfolder
SHGetFolderPathA
pcichek
IsILS
IsJPIK
CheckLicenseString
pcicapi
CapiClose
CapiOpen
CapiListen
CapiHangup
mpr
WNetAddConnection2A
WNetCancelConnection2A
WNetGetConnectionA
comctl32
ImageList_Draw
ImageList_LoadImageA
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetImageCount
ord17
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Create
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
winmm
waveOutClose
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutUnprepareHeader
waveInPrepareHeader
waveOutSetVolume
waveOutOpen
waveInStart
waveInOpen
waveOutWrite
waveOutPrepareHeader
timeGetTime
timeEndPeriod
timeBeginPeriod
PlaySoundA
waveInAddBuffer
wsock32
inet_addr
send
setsockopt
bind
listen
accept
htons
socket
connect
getpeername
gethostbyname
recv
shutdown
closesocket
WSACleanup
WSAStartup
WSAGetLastError
gethostname
htonl
ioctlsocket
kernel32
HeapFree
HeapAlloc
GetProcessHeap
IsBadReadPtr
SizeofResource
CreateDirectoryA
RemoveDirectoryA
MoveFileA
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetVolumeInformationA
FileTimeToDosDateTime
FileTimeToLocalFileTime
OpenEventA
FindResourceA
OutputDebugStringA
SetCurrentDirectoryA
LocalAlloc
GetTimeFormatW
GetDateFormatW
RaiseException
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
lstrlenW
lstrlenA
lstrcmpiA
FlushInstructionCache
lstrcmpA
FindResourceExA
TerminateThread
ReleaseMutex
WaitForSingleObjectEx
GlobalReAlloc
CreateNamedPipeA
ConnectNamedPipe
SetProcessShutdownParameters
SetConsoleCtrlHandler
IsDBCSLeadByteEx
DisconnectNamedPipe
WriteProfileStringA
DefineDosDeviceA
QueryDosDeviceA
TryEnterCriticalSection
ResumeThread
VirtualQueryEx
GetThreadContext
ReadProcessMemory
PulseEvent
CreateRemoteThread
SetThreadContext
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
Beep
GetSystemDefaultLangID
GetSystemInfo
SuspendThread
OpenThread
GetProcessVersion
GlobalGetAtomNameA
RtlUnwind
DecodePointer
EncodePointer
InterlockedCompareExchange
LoadResource
LockResource
VirtualProtectEx
WriteProcessMemory
GetExitCodeThread
CompareStringA
SetFilePointer
GetProfileStringA
GetOEMCP
GetShortPathNameA
TerminateProcess
SystemTimeToFileTime
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreatePipe
DuplicateHandle
SetHandleInformation
FormatMessageA
LocalFree
SetNamedPipeHandleState
GetPriorityClass
WinExec
SearchPathA
IsValidCodePage
SetSystemTime
_lopen
_lclose
DeleteFileA
SetFileAttributesA
GetSystemDirectoryA
GetDateFormatA
GetTimeFormatA
GlobalSize
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
SetErrorMode
GetACP
SetPriorityClass
GetFileAttributesA
GetTempFileNameA
CopyFileA
FileTimeToSystemTime
GetComputerNameA
ExitProcess
GetModuleHandleA
GetExitCodeProcess
GetCurrentProcess
LoadLibraryExA
ExitThread
GetDriveTypeA
GetWindowsDirectoryA
IsDBCSLeadByte
GetLocalTime
GetFileSize
GlobalAlloc
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
GetSystemPowerStatus
ExpandEnvironmentStringsA
FindFirstFileA
FindNextFileA
FindClose
GetUserDefaultUILanguage
GetUserDefaultLangID
GetModuleFileNameA
GetCurrentProcessId
CreateProcessA
DeleteCriticalSection
InitializeCriticalSection
GetVersion
CreateThread
SetThreadPriority
InterlockedIncrement
WaitForMultipleObjects
GetOverlappedResult
ResetEvent
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeviceIoControl
InterlockedExchange
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
CreateFileA
GetTempPathA
WriteFile
GetCurrentThreadId
CreateEventA
WaitForSingleObject
SetEvent
GlobalDeleteAtom
Sleep
GlobalAddAtomA
OpenProcess
GetVersionExA
GetTickCount
CloseHandle
HeapReAlloc
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetModuleHandleW
VirtualQuery
GetConsoleMode
GetCommandLineA
LCMapStringW
GetCPInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
HeapSize
GetLocaleInfoW
SetHandleCount
GetFileType
GetStartupInfoW
GetConsoleCP
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetTimeZoneInformation
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
FlushFileBuffers
LoadLibraryW
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
MultiByteToWideChar
user32
CreateCursor
HideCaret
OemToCharBuffA
ScrollWindow
SetScrollPos
SetScrollRange
ClipCursor
DrawIconEx
RemoveMenu
SetActiveWindow
AdjustWindowRectEx
TrackPopupMenuEx
SetMenuDefaultItem
InsertMenuItemA
EndMenu
LoadStringW
SetMenuInfo
GetMenuInfo
GetScrollInfo
SetScrollInfo
TileWindows
GetScrollRange
GetWindowRgn
GetAsyncKeyState
EnumThreadWindows
EnumDisplaySettingsA
CreateDesktopA
PostMessageW
OpenInputDesktop
GetMenuItemRect
mouse_event
MapVirtualKeyA
CharLowerBuffA
ShowCursor
SwitchDesktop
AttachThreadInput
GetCursor
CreateDialogIndirectParamA
DialogBoxIndirectParamA
DialogBoxParamA
SetClassLongA
MapDialogRect
CreateAcceleratorTableA
DestroyAcceleratorTable
RedrawWindow
InvalidateRgn
CharNextA
LoadAcceleratorsA
ScreenToClient
ModifyMenuA
CreateMenu
MoveWindow
SetCursorPos
DrawTextW
IsDialogMessageA
UnionRect
DrawFocusRect
wsprintfW
EndDialog
OpenWindowStationA
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
MsgWaitForMultipleObjects
GetUserObjectSecurity
SetUserObjectSecurity
MessageBoxIndirectA
WinHelpA
UnhookWindowsHookEx
SetWindowsHookExA
CreateDialogParamA
GetLastActivePopup
CallNextHookEx
GetUpdateRect
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyCursor
GetActiveWindow
IsZoomed
CreatePopupMenu
AppendMenuA
CopyRect
EqualRect
LoadStringA
ClientToScreen
DeferWindowPos
IsChild
GetWindowPlacement
TranslateAcceleratorA
SetRectEmpty
SetMenu
SetWindowPlacement
GetForegroundWindow
CharUpperBuffA
WindowFromPoint
WaitForInputIdle
GetUserObjectInformationA
GetCursorPos
CheckDlgButton
SetForegroundWindow
EnumChildWindows
RegisterClipboardFormatA
CountClipboardFormats
EnumClipboardFormats
GetClipboardData
IsClipboardFormatAvailable
GetClipboardFormatNameA
RegisterWindowMessageA
DestroyIcon
CharUpperA
ExitWindowsEx
GetDesktopWindow
MessageBoxA
keybd_event
GetThreadDesktop
SetThreadDesktop
wvsprintfA
CreateCaret
ShowCaret
UnregisterClassA
SetTimer
KillTimer
SetDlgItemTextA
SendMessageA
SendDlgItemMessageA
PostMessageA
ShowWindow
DefWindowProcA
CallWindowProcA
PostThreadMessageA
GetQueueStatus
GetDlgItem
GetDlgCtrlID
GetDC
ReleaseDC
InvalidateRect
DestroyCaret
GetKeyState
PeekMessageA
SetCaretPos
DrawMenuBar
GetSystemMenu
OpenClipboard
EmptyClipboard
SetClipboardData
MessageBeep
CloseClipboard
FindWindowExA
DeleteMenu
GetWindowTextLengthA
GetFocus
GetClassInfoExA
DestroyWindow
DefDlgProcA
RegisterClassExA
IsDlgButtonChecked
GetDlgItemTextA
IsIconic
GetMenu
SystemParametersInfoA
IntersectRect
GetCursorInfo
GetIconInfo
IsWindowVisible
GetWindow
SendMessageTimeoutA
GetClassLongA
CopyIcon
CopyImage
LoadImageA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
EnumWindows
GetClassNameA
GetClassInfoA
LoadIconA
RegisterClassA
BringWindowToTop
GetMessageA
TranslateMessage
DispatchMessageA
SetPropA
GetPropA
RemovePropA
GetCapture
SetCapture
ReleaseCapture
CreateWindowExA
BeginPaint
EndPaint
wsprintfA
PostQuitMessage
GetMenuItemID
CheckMenuItem
EnableMenuItem
GetMenuItemInfoA
SetMenuItemInfoA
PtInRect
GetWindowDC
LoadMenuA
GetSubMenu
GetMenuItemCount
DestroyMenu
InflateRect
GetSystemMetrics
FindWindowA
GetWindowThreadProcessId
IsWindow
SetFocus
SetWindowPos
GetParent
GetWindowTextA
SetWindowTextA
GetWindowLongA
MapWindowPoints
GetClientRect
DrawTextA
OffsetRect
IsWindowEnabled
SetRect
GetWindowRect
FillRect
LoadBitmapA
GetSysColor
SetCursor
LoadCursorA
UpdateWindow
EnableWindow
SetWindowLongA
gdi32
EndPage
StartPage
ExtEscape
ExtTextOutA
AddFontResourceA
RemoveFontResourceA
SelectPalette
RealizePalette
EqualRgn
CreatePalette
CreateBrushIndirect
GetDCOrgEx
SetBrushOrgEx
PatBlt
CreatePatternBrush
GetTextMetricsA
StretchBlt
GetSystemPaletteEntries
GetNearestPaletteIndex
GetBkMode
CreateFontIndirectW
SetBitmapBits
UnrealizeObject
SetDIBits
SetTextCharacterExtra
SetRectRgn
CreatePenIndirect
GetClipRgn
GetWindowOrgEx
IntersectClipRect
Arc
Chord
Pie
Polyline
RoundRect
SetPolyFillMode
CreateDIBitmap
SetTextJustification
SetBkMode
SetTextColor
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
CreateDIBSection
GdiFlush
GetRegionData
CombineRgn
CreateRectRgn
CreateRectRgnIndirect
PtInRegion
SelectObject
GetObjectA
BitBlt
DeleteDC
RectVisible
SetWindowOrgEx
DeleteObject
GetPaletteEntries
GetTextColor
GetBkColor
GetTextExtentPoint32A
GetMapMode
SetMapMode
GetStretchBltMode
SetStretchBltMode
GetBitmapBits
BeginPath
TextOutA
EndPath
PathToRegion
GetRgnBox
OffsetRgn
FillRgn
FrameRgn
CreateBitmap
CreateDCA
SelectClipRgn
LineDDA
Polygon
CreateFontIndirectA
CreateHatchBrush
GetDeviceCaps
SetBkColor
ExtFloodFill
GetPixel
SetPixel
SetPixelV
Ellipse
Rectangle
SetROP2
MoveToEx
LineTo
GetStockObject
CreatePen
CreateSolidBrush
GetTextExtentPointA
RectInRegion
winspool.drv
EnumPrinterDriversA
DeletePrinter
AddPrinterA
EnumPrintersA
ord201
ord202
EnumJobsA
SetJobA
AbortPrinter
StartPagePrinter
WritePrinter
StartDocPrinterA
OpenPrinterA
ClosePrinter
EndPagePrinter
EndDocPrinter
GetPrinterA
comdlg32
PageSetupDlgA
GetOpenFileNameA
GetSaveFileNameA
ChooseFontA
advapi32
EnumServicesStatusA
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyA
SetTokenInformation
SetServiceStatus
StartServiceCtrlDispatcherA
LogonUserA
ControlService
StartServiceA
RegQueryInfoKeyW
CryptGetProvParam
CryptReleaseContext
AllocateLocallyUniqueId
FreeSid
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
LookupPrivilegeValueA
AdjustTokenPrivileges
QueryServiceConfigA
CreateProcessAsUserA
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
IsValidSid
GetLengthSid
CopySid
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegFlushKey
RegOpenKeyExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
GetUserNameA
LookupPrivilegeNameA
RegQueryValueExA
GetTokenInformation
LookupAccountSidA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
EqualSid
RevertToSelf
OpenProcessToken
ImpersonateLoggedOnUser
GetUserNameW
shell32
ExtractIconExA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHGetMalloc
SHGetDesktopFolder
SHGetPathFromIDListA
FindExecutableA
ExtractIconA
Shell_NotifyIconA
ShellExecuteA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
StringFromGUID2
ReleaseStgMedium
OleDuplicateData
CreateDataAdviseHolder
CoTaskMemFree
CLSIDFromProgID
OleInitialize
OleUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
OleLockRunning
CoInitializeSecurity
CoInitializeEx
OleCreateStaticFromData
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSetContainedObject
IIDFromString
CLSIDFromString
CoGetClassObject
oleaut32
SysStringByteLen
OleLoadPicture
SysFreeString
SysAllocString
VariantClear
VariantInit
VariantChangeType
SysStringLen
SysAllocStringLen
VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
OleCreatePictureIndirect
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayCreate
VariantCopy
oleacc
AccessibleObjectFromWindow
netapi32
NetUserEnum
NetApiBufferFree
wininet
InternetCrackUrlA
_GetRawWMIStringW@16
_GetWMIStringW@16
_IsAcerA@8
_NSMClient32@8
_NSMFindClass@12
br_close
br_open
br_poll
br_status
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
312KB
Virtual Size
311KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
47KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.hhshare
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=42, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=171, productName=VS2010 build 30319, version=30319,
count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=853, id=1, productName=Unmarked objects,
count=254, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=211, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
TCCTL32.DLL
- IMPHASH 2c4d798bb87ec57193b7625c4259da43
- SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- MD5 2c88d947a5794cf995d2f465f1cb9d10
- SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP 12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
- MD5 SHA1 SHA512 SSDEEP
Digest
a3:3f:41:12:a2:5c:25:dd:c6:a7:1a:1b:c7:28:0d:33:9b:79:75:b3:2b:2d:fd:bb:9b:37:a4:83:e9:a3:46:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
0f:54:fc:aa:4d:b0:4d:d4:93:19:dd:0b:92:d9:85:18:59:22:b6:56
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
1
Major OS version
5
Entry point
187175
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
kernel32
GetLastError
WriteFile
ReadFile
Sleep
ClearCommError
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
GetModuleFileNameA
DeleteCriticalSection
CloseHandle
TerminateThread
SetEvent
CreateEventA
GetTickCount
SetThreadPriority
CreateThread
SetCommTimeouts
InitializeCriticalSection
GetCommState
IsDBCSLeadByte
CompareStringA
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
OutputDebugStringA
OpenProcess
GetCurrentProcessId
GetVersionExA
GetLocalTime
GetOverlappedResult
GetCurrentThreadId
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
LocalFree
PulseEvent
InterlockedExchange
GetExitCodeThread
ResetEvent
GetVersion
SetLastError
EscapeCommFunction
GetCommModemStatus
CreateDirectoryA
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
lstrlenW
lstrlenA
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
CreateFileA
FlushFileBuffers
SetStdHandle
LoadLibraryW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
WaitForSingleObject
GetStringTypeW
FatalAppExitA
GetUserDefaultLCID
GetTempPathA
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
HeapSize
SetFilePointer
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapDestroy
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
RaiseException
EncodePointer
DecodePointer
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetCurrentThread
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
HeapCreate
user32
CharLowerA
PostThreadMessageA
PostMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
MessageBoxA
KillTimer
PeekMessageA
PostQuitMessage
wsprintfA
wvsprintfA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
GetUserNameA
oleaut32
SysAllocStringLen
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
VariantChangeType
VariantClear
SysStringByteLen
CreateErrorInfo
GetErrorInfo
SysAllocString
SetErrorInfo
SysFreeString
VariantInit
?RemoteNotify@@YAXP6GHHPAXPATCTL_CALLBACK@@@Z0@Z
ctl_bridgename
ctl_broadcastdata
ctl_call
ctl_callremote
ctl_close
ctl_closeremote
ctl_connected
ctl_escape
ctl_findslaves
ctl_findslavesex
ctl_getcodepage
ctl_getlocalipaddressinuse
ctl_getsession
ctl_hangup
ctl_helpreq
ctl_installed
ctl_maxpacket
ctl_myaddr
ctl_netname
ctl_networks
ctl_nsessions
ctl_open
ctl_openremote
ctl_pause
ctl_pingnet
ctl_remotename
ctl_send
ctl_sendex
ctl_sendif
ctl_sendname
ctl_sendto
ctl_subset
ctl_version
Name
.text
Size
305KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=24, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=149, id=1, productName=Unmarked objects,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
client32.exe
- IMPHASH 78ed70ebeb178ed1bae5921d2ed514bc
- SHA256 18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
- MD5 c4f1b50e3111d29774f7525039ff7086
- SHA1 57539c95cba0986ec8df0fcdea433e7c71b724c6
- SHA512 005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
- SSDEEP 768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NetSupport Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=NetSupport,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
7d:2d:0c:a0:6f:4d:88:04:2d:cb:64:48:2b:c9:c0:64
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2011 - Aug 20, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\nsmsrc\nsm\1200\1200\client32\Release\client32.pdb
pcicl32
_NSMClient32@8
kernel32
GetCommandLineA
ExitProcess
GetModuleHandleA
GetStartupInfoA
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
342B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
client32.ini
- SHA256 b2caadb660455f1aaf3737b93879e35d05602be1fdf2531602fd61e006e8c80a
- MD5 c94845bb509056e66ee5767759c9e5bd
- SHA1 c1b6e003cf0ab1f236375faebe8707d519fd8a3d
- SHA512 6c3750804763221bc72031c051eb9ae67874ffae7795f96435ef577ff3f7e84f5a42c9715ebbde53b1bd9e9ad5b7e59a691ab36df2267a5a5fc2c84f032d1e86
- MD5 SHA1 SHA512
install/02a7244d2ed058ed_0
- SHA256 be034ea1f3976ab87f830eb1d4fb916ddf1db6ea6c8c9f9d75dc71c3f0a5caf0
- MD5 e0be862e27b5a94df107fc1aa696f8aa
- SHA1 5ac5273c63e6a9ceb9c89ff20d7c55e95817d64e
- SHA512 984070bb123c3c074ac6717b016568455be56f0af4700421b886af50ca8d7f08647f7d0eb2fc7e7bb2240473271f55ec83af6eecb3869822c80c8e5e00f15c2e
- MD5 SHA1 SHA512
install/1a7d70470ec607c8_0
- SHA256 d2dbb19cee47d25097db6e0ca61ba9615d6b026b9a1e55236ea5b0f60260b11f
- MD5 72e1abe9304de8ed9e9c887db9c203f0
- SHA1 d6002a81ae998a398f1b1557eac9890cab90db0f
- SHA512 858133f725c4374a9df91366778eb41150f7e04fe1a1bd7253674f532763411be95ebf525b3f331d7fa4155a1831fa0a296eb817f8817623eb5afa9f82b5da1f
- MD5 SHA1 SHA512
install/24.4.4.1168.manifest
- SHA256 570e26e2e0c74a1550af9d91b0ab11c2ac65eef172c9ae62626a6b7a20f6ce99
- MD5 2bc6a1bed7998c7257d29529a30abef8
- SHA1 d2d61a45e9283f2fd6f491d06f683f391af4319b
- SHA512 caf0c628974b5caf2b3f819ff741bfd9b13d16049106f90c3f4e2d701c1816a4b5b456b9d596656e09c95d276dcc117719109e0aded1e23b214e25954d7a8b45
- MD5 SHA1 SHA512
install/24.6.0.1874.manifest
- SHA256 27b3966207735d3b1d0d4c04bc2a80e320137a8be100d0b8e28a24cdb3dff1a9
- MD5 6633d1b6189f62f16cf0e1c185caca31
- SHA1 3a494df42cf9b5afb52a4c6eb14ac6548a643dfa
- SHA512 01f62ee74058fd14b90612c3e757f23e0bd1aa731b3717bdbf9cc1b08357f1485863de2dca81ed2333da19e34ae44d3688cc4b0c3bb739c9444659f5e88b515f
- MD5 SHA1 SHA512
install/2a9877b782e7616c_0
- SHA256 35a82e2e896ab0129a3a01aba72f20af0a5d09dc351c6d0250cd849c15dc090c
- MD5 39846803ac3f83839365ce751d1870e7
- SHA1 1eac7e342ae8a1cbb09e01c2f2e658b06f45458d
- SHA512 063dd219c835a58206254301a7ac896580efdb6f762e0f1d81a9ebb56a19eb1bb842f87d1e233ca42d712f30881d9657c98edc3a1b0cb351ac986cb29444647d
- SSDEEP 768:RSfmGe+DIGpLQRDB52wdpZi1YUTuZN5t4pYjsxsUr27KlvuMPDOyGc21T6WW:R8mGe+DHpQn524pUYUTuZ/WYjsxPrzuE
- MD5 SHA1 SHA512 SSDEEP
install/StartVoiceCapture.wav
- SHA256 4f007ce7bc6c3df2931862ad0ae04a656dda7bd06caa6bf222ea59c466ed7d7f
- MD5 9c081028ed5610f5428f579bd080eb8c
- SHA1 1c388a37715a6662f0027faae864b22ae5222193
- SHA512 e8f7fd443832b0b39a29653b7a42d9fb01d30aeb7fdcc140ce4b1ce62752cb41708d3580b418d327bcb943d6c47c85491380993e1803e1387faae07c2032c3e4
- SSDEEP 1536:rFVQkkvDaCMsXW1gXyT4aczfrLgcTPkU7H1wtmL/:8k3C17XysrTgIPbGkD
- MD5 SHA1 SHA512 SSDEEP
install/browser.VisualElementsManifest.xml
- SHA256 1f5796532069af1a770b29646a067d4bdfbdd297094fff815bbbbec7565cb937
- MD5 452f6c49c49e0dfd6f2889051be44cad
- SHA1 bf7ef560ec8b9bccacd9abf1d738d8c932c0385b
- SHA512 45741a8b7a0ef0c6df67f1e3a2647936e5b2c40dc6330b2f6a442a9191f2fbee28cf43dff7ccfcf58ff50b8134fe1867fc361bdb7db2ffc94d183e89067ea504
- MD5 SHA1 SHA512
install/camera_mf_trace.wprp
- SHA256 3f2eb6455f54365c27829f85dd64ca0bafaa8577a6c8e79a54a6dd4c67df6470
- MD5 8028ab84d61fc5e00feea816e1d1e293
- SHA1 73f6340be4c6b5af09673dacdf1aab7405b966aa
- SHA512 276df846f72f2b410852f0709f3effd853c3b012e94a6a3dffb364f9597d4ccfe453b6533ce7a67c9dce5b829c0f96e9838a267269687213d996b60591c586f0
- SSDEEP 384:PlBJHEA29f27X0JS4zuPxpO8psP+E7v6xKL:P9b29f27kJSAuPxpO6sP+E7yxKL
- MD5 SHA1 SHA512 SSDEEP
install/chrome.VisualElementsManifest.xml
- SHA256 fae6a7f7c53e82448c8f354b3a74a2bc785ff031d87929472e2fde13e1c059f6
- MD5 437001161184cadaa8c0a0d7986c644a
- SHA1 6625882ae191e0652df47d248ac7c6cb67b6b37a
- SHA512 9312506d0a3f9047e7234de449b3447a0293b8b7d3f2d22a25b862adf84724e211394abf99e3bdecf40a403050399f1007407e165deef5ff9475d833909b10e1
- MD5 SHA1 SHA512
install/config.cfg
- SHA256 75e5816defbc2fe2e2d221db35c2a7eba3637ba960be7dc0bb727a700ebd2421
- MD5 badf79377459ca427e86697b692e430c
- SHA1 8fb55e71aa4a779f30c41f226c88f721f97e2498
- SHA512 6d68ccc692fc6b1a71e21fbdf3829eb5b020ee1acea111a138362c1bf448c0be1c70d07dc4871baf5230134222f67cc019f00310d366d645a6c77369ff5a7b81
- MD5 SHA1 SHA512
install/cs.pak
- SHA256 69be067037e663e9ab42fbe0935e8b177970dfb877c35479169af444040d03e2
- MD5 f3e8373cb339b00f9e1464da082272e2
- SHA1 3e2fd5caf0e8423c4955bba1a9483ff02f5bc477
- SHA512 4bc1ba072e7ee3f7b1600482ea8a809d082e31f1456de8b5ae3b1c23e3a11bb5d7804524bc5ad6688d3b0e61f41cd75de95df1539ccefcc1456cb9f429ffc15a
- SSDEEP 6144:ySwb4rE54xOdA9R1zWt9yqISBjHzWXQ5EvKINZ:ydb4rQBe1zWt9HISNHz0j
- MD5 SHA1 SHA512 SSDEEP
install/de.pak
- SHA256 a57963c23fbd040c5ef934ec38ca1da08a083068257865f85d3b9614758e4ba1
- MD5 b24f89133cffdafaa7bcc02cc6622864
- SHA1 b20c87534dc1ee169618ea42acbfa361804edc54
- SHA512 6f665a95b6667e5ac0cd9ef2bffad35a607a838b9a892b0f3328bd69d2015f2098a5b07b33c1c94460d173685d72bce048b7b98fed9e82748e6f5047eb22c666
- SSDEEP 6144:DLAdZ1dDLOOGpUZ92zTFqZIABpznhMogBVMro7edvP9iAt9:DLA711KZSmOjHgBVwoIf
- MD5 SHA1 SHA512 SSDEEP
install/delegatedWebFeatures.sccd
- SHA256 ca6c469655d4d0d7ce5beb447dab43048a377a6042c4800b322257567ac135d9
- MD5 7fd9cd05f23d42fb6deda65bd1977ac9
- SHA1 df25a2c9e1e9fa05805da69ff41337b9f59755fb
- SHA512 6ae8addf0c55058803305f937593ba02202c99639a572be0cacbfde598019cf8db7067e0392bd66c43cf7d8780e454ec5e08d68bcfd491b60a450ffc280c81b8
- SSDEEP 384:nPzOC+5CNMCUDCGxkKp2Z+TgNKvoUwyBDZS/1pMimimp5F9aQBb+ZIo1PCCZAhy1:niZtnLkKp2Z+TgNKvoUwqVS/L3mimp5i
- MD5 SHA1 SHA512 SSDEEP
install/en-US.pak
- SHA256 8c437a858e53894c6072d521459662feceb3b1e416f62f3f4961d1f6c62b4c9d
- MD5 1761dc1760c752b6a16bf6f8797b207b
- SHA1 ae0c16af795ada3047f086dc841f66ff561ff139
- SHA512 ebce0fe7f70e4f8698b3a758c58309f461a25ddffa413b8440edfe593f70ee4d26046e3fe36eb1f01a4c0fa042270eab29d2d717b0a02f1994870e1d9f4bbe09
- SSDEEP 6144:vxWr2xoTIpupSwg1QMMXntfaY46yX1/PrMN8xKHfHqzHs:8r2WTqUl5MOnqavqY
- MD5 SHA1 SHA512 SSDEEP
install/fr.pak
- SHA256 9fcb23edfb0c68015eb5dc54b2fa48e2e5c3410facd56547a33b6888ec71e079
- MD5 ddfcac89248fdc7c51c1a932b6ac1c37
- SHA1 b16577290a95346b74c84d95f3b3763219be999c
- SHA512 84e812c5e0fd0f61ec370d3751ed5f0059e62566e8be125d705b37dcdb5a04b82399d531c261278d4e9292923edbce67b49cfceb57263b83292c695f745732ed
- SSDEEP 12288:EpFCZh0dne0ymuV8iObj/9XY441LSPwOi6PtQE0sIkcOBZfb9NVmEV//QpSY:EPC/9VVLcd/Qj
- MD5 SHA1 SHA512 SSDEEP
install/manifest.json
- SHA256 333654272a482dc66a15d07c778cdfed72e74f6fa50342f00995e26f5dc7678f
- MD5 cba80ee11de525535bf2068ac23107b0
- SHA1 479c817e5b4ae2e49e1e950359f072dd8a8d227f
- SHA512 5acdfd8874e3506c65446f5b5022879b74d5faa4d05af36c9835a35e542bab21d81af0f334403f9f3597b12c20c52e2de9377ed7b22466dea3d7ece47810d5f8
- MD5 SHA1 SHA512
install/mf_trace.wprp
- SHA256 79a228f8f85310c27c292055d9e0e9b827c319c2472b4ba5b40e88851bc4b4f3
- MD5 aa55e1c8f1bafc80e31dadd952e8563e
- SHA1 e9fb430500eb4f634935ae7dd1ef8395828ddf0d
- SHA512 73b7b6831567a5373db663683c0352cec50de0183a378af6bc989c8a06b02735a1f535c582b7b680fe3dfbf2d4c5404faf99ec9cdfc9f0a3f135715d309ebab4
- SSDEEP 192:PAFGMAwWa5wKa5waa5wia5wGa5wIWUa5w2a5wia5wGa5wa5wmn5wYG5w55wb5wHu:4FGMfWUmgOeWiu6mL
- MD5 SHA1 SHA512 SSDEEP
install/preloaded_data.pb
- SHA256 c352da21a972a669694c7178deadc41c9be440bd92bdac827fe96b79caac007e
- MD5 649c99af46addf93fdd5a214fb56e738
- SHA1 322376c0cebf89d49f86337d6832441befd7c76f
- SHA512 01fae333dd9480c6e638b151f84afa6a6d3c0f2e9ae0af1dc9c54795ecaa6bfb348ca80f792c0bbb9527a3b1d7b5a701ab637b12a61279e6764173b9c8ff8247
- SSDEEP 192:sinu4QlEV/xIZKJmj99zRbxJKsO01dKxFJ:sinu4Qlm5ICmj99zRbxEvJxFJ
- MD5 SHA1 SHA512 SSDEEP
install_state.json
- SHA256 d53fc339533d39f413ddd29a69ade19f2972383db8fb8938d77d2e79c8573f36
- MD5 3f78a0569c858ad26452633157103095
- SHA1 8119bcc1d66b17ccd286fef396fa48594188c4d0
- SHA512 89842e39703970108135d71ce4c039df19c18f04c280cb2516409758f9d22e0205567b08dbe527a6fb7c295bda2ea8ee6a368d6fcaf6fb59645d31ef2243ad3d
- MD5 SHA1 SHA512
msvcr100.dll
- IMPHASH 5271d5ce8b44dd47bc92563e27585466
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 11, 2011
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:b2:9b:00:00:00:00:00:15
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 21, 2011 - May 21, 2012
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
5
Entry point
73212
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcr100.i386.pdb
kernel32
EncodePointer
DecodePointer
RaiseException
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileExA
FindClose
FindNextFileW
FindFirstFileExW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Sleep
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
GetDriveTypeA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetEvent
CreateEventW
SwitchToThread
SignalObjectAndWait
TryEnterCriticalSection
GetTickCount
VirtualFree
GetVersionExW
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetProcessAffinityMask
VirtualProtect
SetThreadAffinityMask
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
GetThreadPriority
LoadLibraryW
SleepEx
OutputDebugStringW
FreeLibraryAndExitThread
GetModuleHandleA
GetThreadTimes
DebugBreak
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW
RtlUnwind
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
HeapCompact
HeapWalk
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoW
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
CreateFileW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreatePipe
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetProcessHeap
InterlockedExchange
LockFile
UnlockFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetConsoleCtrlHandler
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringW
CompareStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsProcessorFeaturePresent
$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@details@Concurrency@@QAE@PBD@Z
??0task_canceled@details@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@IAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_invalid_parameter_handler
_get_osfhandle
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getptd
_getsystime
_getw
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_hypotf
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initptd
_initterm
_initterm_e
_inp
_inpd
_inpw
_invalid_parameter
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_iob
_isalnum_l
_isalpha_l
_isatty
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_isnan
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_itoa
_itoa_s
_itow
_itow_s
_j0
_j1
_jn
_kbhit
_lfind
_lfind_s
_loaddll
_local_unwind2
_local_unwind4
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_lock
_lock_file
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lsearch_s
_lseek
_lseeki64
_ltoa
_ltoa_s
_ltow
_ltow_s
_makepath
_makepath_s
_malloc_crt
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mbctype
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l
_memccpy
_memicmp
_memicmp_l
_mkdir
_mkgmtime32
_mkgmtime64
_mktemp
_mktemp_s
_mktime32
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_purecall
_putch
_putch_nolock
_putenv
_putenv_s
_putw
_putwch
_putwch_nolock
_putws
_pwctype
_read
_realloc_crt
_recalloc
_recalloc_crt
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotl64
_rotr
_rotr64
_scalb
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_searchenv
_searchenv_s
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_SSE2_enable
_set_abort_behavior
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_fmode
_set_invalid_parameter_handler
_set_malloc_crt_max_wait
_set_output_format
_set_printf_count_output
_set_purecall_handler
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sopen
_sopen_s
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_splitpath_s
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_stat32
_stat32i64
_stat64
_stat64i32
_statusfp
_statusfp2
_strcoll_l
_strdate
_strdate_s
_strdup
_strerror
_strerror_s
_strftime_l
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strtime
_strtime_s
_strtod_l
_strtoi64
_strtoi64_l
_strtol_l
_strtoui64
_strtoui64_l
_strtoul_l
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_swab
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_sys_errlist
_sys_nerr
_tell
_telli64
_tempnam
_time32
_time64
_timezone
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_tzname
_tzset
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_umask
_umask_s
_ungetc_nolock
_ungetch
_ungetch_nolock
_ungetwc_nolock
_ungetwch
_ungetwch_nolock
_unlink
_unloaddll
_unlock
_unlock_file
_utime32
_utime64
_vcprintf
_vcprintf_l
_vcprintf_p
_vcprintf_p_l
_vcprintf_s
_vcprintf_s_l
_vcwprintf
_vcwprintf_l
_vcwprintf_p
_vcwprintf_p_l
_vcwprintf_s
_vcwprintf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_waccess
_waccess_s
_wasctime
_wasctime_s
_wassert
_wchdir
_wchmod
_wcmdln
_wcreat
_wcscoll_l
_wcsdup
_wcserror
_wcserror_s
_wcsftime_l
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcstod_l
_wcstoi64
_wcstoi64_l
_wcstol_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wctomb_l
_wctomb_s_l
_wctype
_wdupenv_s
_wenviron
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wfullpath
_wgetcwd
_wgetdcwd
_wgetdcwd_nolock
_wgetenv
_wgetenv_s
_wmakepath
_wmakepath_s
_wmkdir
_wmktemp
_wmktemp_s
_wopen
_wperror
_wpgmptr
_wpopen
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wputenv
_wputenv_s
_wremove
_wrename
_write
_wrmdir
_wscanf_l
_wscanf_s_l
_wsearchenv
_wsearchenv_s
_wsetlocale
_wsopen
_wsopen_s
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wsystem
_wtempnam
_wtmpnam
_wtmpnam_s
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wunlink
_wutime32
_wutime64
_y0
_y1
_yn
abort
abs
acos
asctime
asctime_s
asin
atan
atan2
atexit
atof
atoi
atol
bsearch
bsearch_s
btowc
calloc
ceil
clearerr
clearerr_s
clock
cos
cosh
div
exit
exp
fabs
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
floor
fmod
fopen
fopen_s
fprintf
fprintf_s
fputc
fputs
fputwc
fputws
fread
fread_s
free
freopen
freopen_s
frexp
fscanf
fscanf_s
fseek
fsetpos
ftell
fwprintf
fwprintf_s
fwrite
fwscanf
fwscanf_s
getc
getchar
getenv
getenv_s
gets
gets_s
getwc
getwchar
is_wctype
isalnum
isalpha
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
labs
ldexp
ldiv
llabs
lldiv
localeconv
log
log10
longjmp
malloc
mblen
mbrlen
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
modf
perror
pow
printf
printf_s
putc
putchar
puts
putwc
putwchar
qsort
qsort_s
raise
rand
rand_s
realloc
remove
rename
rewind
scanf
scanf_s
setbuf
setlocale
setvbuf
signal
sin
sinh
sprintf
sprintf_s
sqrt
srand
sscanf
sscanf_s
strcat
strcat_s
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strerror_s
strftime
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strrchr
strspn
strstr
strtod
strtok
strtok_s
strtol
strtoul
strxfrm
swprintf_s
swscanf
swscanf_s
system
tan
tanh
tmpfile
tmpfile_s
tmpnam
tmpnam_s
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
vfprintf_s
vfwprintf
vfwprintf_s
vprintf
vprintf_s
vsprintf
vsprintf_s
vswprintf_s
vwprintf
vwprintf_s
wcrtomb
wcrtomb_s
wcscat
wcscat_s
wcschr
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcsftime
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsrchr
wcsrtombs
wcsrtombs_s
wcsspn
wcsstr
wcstod
wcstok
wcstok_s
wcstol
wcstombs
wcstombs_s
wcstoul
wcsxfrm
wctob
wctomb
wctomb_s
wmemcpy_s
wmemmove_s
wprintf
wprintf_s
wscanf
wscanf_s
Name
.text
Size
709KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=490, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=52, id=175, version=40219,
count=184, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
new_chrome_proxy.exe
- IMPHASH 140ff2ef9713229377b0108ca6c1aa4e
- SHA256 4c3c87dc4850acfca4e135a329230534404949262e6c1e4d775cd9992762f732
- MD5 37b91de52dd423ac20398b70b9844b36
- SHA1 bf5748fd56910243f949d787b27f73fc325c0acf
- SHA512 c0a33f6808630adb67f9214c8cc8274581720ec8318ddaf93abf60737ccd02efc62a32fd9e2b8b8b531438dabd2a01379003478c0a0a57444ebe8ef1d7c14888
- SSDEEP 12288:mRdaQNYEYh4L5UaB1a1bxyOG6KA5bxjvzSdbaJfhBHAwjcwUDmxrPoUX7:QDYh4L5HBOEOGLqrzSdutPcIlP1X7
- MD5 SHA1 SHA512 SSDEEP
Digest
ac:7e:67:be:af:a3:c4:7e:91:b5:2b:6f:52:54:9e:fb:b4:74:ca:e2:48:6e:c9:ba:5c:76:b6:2b:62:5d:af:65
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
Chains
Jun 22, 2024
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
Serial Number
0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 2, 2021 - Jul 10, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
10
Entry point
413872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\b\s\w\ir\cache\builder\src\out\Release_x64\chrome_proxy.exe.pdb
advapi32
CreateProcessAsUserW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
kernel32
AcquireSRWLockExclusive
AssignProcessToJobObject
CloseHandle
CompareStringW
CreateEventW
CreateFileW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetFilePointerEx
SetHandleInformation
SetLastError
SetStdHandle
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnregisterWaitEx
UpdateProcThreadAttribute
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrlenA
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
user32
AllowSetForegroundWindow
GetActiveWindow
shell32
CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW
winmm
timeGetTime
ole32
CoTaskMemFree
GetHandleVerifier
Name
.text
Size
779KB
Virtual Size
778KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
58KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
369B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
nskbfltr.inf
- SHA256 d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
- MD5 26e28c01461f7e65c402bdf09923d435
- SHA1 1d9b5cfcc30436112a7e31d5e4624f52e845c573
- SHA512 c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7
- MD5 SHA1 SHA512
nsm_vpro.ini
- SHA256 4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
- MD5 3be27483fdcdbf9ebae93234785235e3
- SHA1 360b61fe19cdc1afb2b34d8c25d8b88a4c843a82
- SHA512 edbe8cf1cbc5fed80fedf963ade44e08052b19c064e8bca66fa0fe1b332141fbe175b8b727f8f56978d1584baaf27d331947c0b3593aaff5632756199dc470e5
- MD5 SHA1 SHA512
pcicapi.dll
- IMPHASH d78463f91aa83e9c39d2e594035ae4bb
- SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- MD5 34dfb87e4200d852d1fb45dc48f93cfc
- SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP 768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
- MD5 SHA1 SHA512 SSDEEP
Digest
3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
1
Major OS version
5
Entry point
15542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb
kernel32
GetProcAddress
GetModuleHandleA
OutputDebugStringA
LoadLibraryA
FreeLibrary
CloseHandle
OpenProcess
GetCurrentProcessId
CreateEventA
InterlockedIncrement
GetVersionExA
GetLocalTime
GetTempPathA
GetCurrentThreadId
GetTickCount
GetLastError
ExitProcess
SetLastError
DisableThreadLibraryCalls
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
SetEvent
InterlockedDecrement
WaitForSingleObject
DeleteCriticalSection
CreateThread
InitializeCriticalSection
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
Sleep
IsDBCSLeadByte
user32
GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
MessageBoxA
KillTimer
PeekMessageA
PostQuitMessage
wvsprintfA
wsprintfA
advapi32
GetTokenInformation
OpenProcessToken
msvcr100
strncpy
_except_handler4_common
strrchr
isdigit
fclose
fopen
strncat
fputs
memset
memcpy
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
CapiClose
CapiConnected
CapiDial
CapiHangup
CapiListen
CapiNotify
CapiOpen
CapiOpen2
CapiRead
CapiSend
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=1, productName=Unmarked objects,
count=3, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
remcmdstub.exe
- IMPHASH 99c0cd957fc7334714fefa3daa61a6ea
- SHA256 fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- MD5 6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1 b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA512 f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP 1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
- MD5 SHA1 SHA512 SSDEEP
Digest
ef:61:d3:a3:35:35:25:ab:43:9a:4d:ec:76:a3:86:24:8a:7c:88:7c:b4:33:c7:c9:13:32:88:a1:47:22:6b:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
34:75:78:92:8b:99:18:cd:b0:19:b2:3d:03:63:f3:20:51:e8:a3:33
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Dec 7, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2016 - Sep 21, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
1
Major OS version
5
Entry point
8628
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
FreeLibrary
GetProcAddress
SetLastError
GetVersionExA
GetLastError
GetModuleFileNameA
WaitForSingleObject
Sleep
WriteFile
GetExitCodeProcess
GenerateConsoleCtrlEvent
WaitForMultipleObjects
CloseHandle
CreateProcessA
SetConsoleCtrlHandler
SetConsoleMode
GetConsoleMode
GetStdHandle
ExpandEnvironmentStringsA
SetStdHandle
WriteConsoleW
HeapSize
SetFilePointer
FlushFileBuffers
GetCommandLineA
HeapSetInformation
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
IsProcessorFeaturePresent
ExitProcess
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryW
HeapReAlloc
GetConsoleCP
CreateFileW
user32
EnumWindows
GetClassNameA
SendMessageA
EnumThreadWindows
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,