acbb5122be6cec9d20e96a12c4cf4374a211e844a2b22ab93433f5b45ad87070

Sharing

Copy URL Twitter E-mail

General

Target

acbb5122be6cec9d20e96a12c4cf4374a211e844a2b22ab93433f5b45ad87070
Size

82.3MB
MD5

4b971ed18e7cb6587f7303b11ef3801f
SHA1

f6751c21af94629edf3b7816504eee91cb6ce614
SHA256

acbb5122be6cec9d20e96a12c4cf4374a211e844a2b22ab93433f5b45ad87070
SHA512

1b9e006a94d9abc4da6ccf5d7cfce41f5398180ab6e4c3c8a892c04ef1ceb0a54fda1e306ca8739cfb14deb0efadd83721a9ccb17aabfa2ec033af8fb6d2bb22
SSDEEP

1572864:lTADOHdN1343bjAtQ4koAC2LSA6sF4EATl4yo+C7kY2L98ganJsJ+CAq9TqV0nEk:MEl4Lj9bPC2ucF4E8l4L+C7kYm98gAJW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Bypass/EasyAnti/libmangler.dll	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/out.upx
unpack001/Startupe.exe

Files

acbb5122be6cec9d20e96a12c4cf4374a211e844a2b22ab93433f5b45ad87070
.zip
Bypass/EasyAnti/BouncyCastle.Crypto.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

23/03/2023, 12:00

Subject

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Signer

Actual PE Digest

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

BouncyCastle.Crypto.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/Bugsnag.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d1:57:b9:73:75:5b:9d:df:ae:de:17:ea:71:0b:59:2f:78:71:f2:58:1b:12:b8:8d:40:f3:36:97:65:0e:e8:9d
Signer

Actual PE Digest

d1:57:b9:73:75:5b:9d:df:ae:de:17:ea:71:0b:59:2f:78:71:f2:58:1b:12:b8:8d:40:f3:36:97:65:0e:e8:9d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\bugsnag-dotnet\src\Bugsnag\obj\Release\net45\Bugsnag.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/Dynamitey.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

98:1e:99:0a:36:af:0c:51:ed:31:cb:9a:08:6d:1c:c5:da:58:5c:c7:29:42:b1:6a:5d:60:ba:8a:09:bd:74:9d
Signer

Actual PE Digest

98:1e:99:0a:36:af:0c:51:ed:31:cb:9a:08:6d:1c:c5:da:58:5c:c7:29:42:b1:6a:5d:60:ba:8a:09:bd:74:9d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\dynamitey\Dynamitey\obj\Release\net40\Dynamitey.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/Google.Protobuf.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/07/2021, 00:00

Not After

10/07/2024, 23:59

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:75:70:18:1f:13:9c:53:02:75:76:6a:cc:87:ca:20:90:b1:40:4c:8c:15:25:e4:52:1e:2a:f9:61:0d:21:ff
Signer

Actual PE Digest

09:75:70:18:1f:13:9c:53:02:75:76:6a:cc:87:ca:20:90:b1:40:4c:8c:15:25:e4:52:1e:2a:f9:61:0d:21:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/csharp/src/Google.Protobuf/obj/Release/net45/Google.Protobuf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/Grpc.Core.Api.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/07/2021, 00:00

Not After

10/07/2024, 23:59

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:fa:11:07:73:38:ec:4c:dc:6f:fb:7e:2f:5b:cb:7d:d7:0f:a5:36:64:c8:3c:f4:12:92:70:84:87:c0:a5:0b
Signer

Actual PE Digest

44:fa:11:07:73:38:ec:4c:dc:6f:fb:7e:2f:5b:cb:7d:d7:0f:a5:36:64:c8:3c:f4:12:92:70:84:87:c0:a5:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/src/Grpc.Core.Api/obj/Release/net462/Grpc.Core.Api.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/Grpc.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/11/2018, 00:00

Not After

17/11/2021, 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:d0:ca:90:b5:89:b9:83:63:f8:b1:5c:35:d7:7c:f5:8e:87:60:32:30:49:48:86:93:32:6c:33:9f:7b:6f:f1
Signer

Actual PE Digest

95:d0:ca:90:b5:89:b9:83:63:f8:b1:5c:35:d7:7c:f5:8e:87:60:32:30:49:48:86:93:32:6c:33:9f:7b:6f:f1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

T:\src\github\grpc\src\csharp\Grpc.Core\obj\Release\net45\Grpc.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/ImpromptuInterface.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:a3:16:6e:9f:d6:53:bf:dd:1c:73:61:0d:97:9b:15:3c:2d:dd:60:0a:55:9d:b9:9d:1c:67:44:02:d1:e2:2b
Signer

Actual PE Digest

69:a3:16:6e:9f:d6:53:bf:dd:1c:73:61:0d:97:9b:15:3c:2d:dd:60:0a:55:9d:b9:9d:1c:67:44:02:d1:e2:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\impromptu-interface\ImpromptuInterface\obj\Release\net40\ImpromptuInterface.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/KeyFile/1033/sqlsysclrtypes_keyfile.dll
.dll windows:6 windows x86 arch:x86

dd949f9c2ea8d8f2d9dbd7c28c3ed8dd

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

24:0d:f8:e2:37:3b:15:c9:8e:61:45:06:5e:4b:6a:70:6a:a6:b3:6a
Signer

Actual PE Digest

24:0d:f8:e2:37:3b:15:c9:8e:61:45:06:5e:4b:6a:70:6a:a6:b3:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

KeyFile.pdb

Imports

msvcr80

_onexit
_lock
_crt_debugger_hook
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_except_handler4_common
_encode_pointer

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/KeyFile/1049/sqlsysclrtypes_keyfile.dll
.dll windows:6 windows x86 arch:x86

dd949f9c2ea8d8f2d9dbd7c28c3ed8dd

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

24:0d:f8:e2:37:3b:15:c9:8e:61:45:06:5e:4b:6a:70:6a:a6:b3:6a
Signer

Actual PE Digest

24:0d:f8:e2:37:3b:15:c9:8e:61:45:06:5e:4b:6a:70:6a:a6:b3:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

KeyFile.pdb

Imports

msvcr80

_onexit
_lock
_crt_debugger_hook
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_except_handler4_common
_encode_pointer

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/KeyFile/SDK/Assemblies/Microsoft.SqlServer.Types.dll
.dll windows:6 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

32:71:0b:07:1e:0a:38:31:e9:79:bf:fd:12:c5:9b:9b:b2:a0:e3:4a
Signer

Actual PE Digest

32:71:0b:07:1e:0a:38:31:e9:79:bf:fd:12:c5:9b:9b:b2:a0:e3:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.SqlServer.Types.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/KeyFile/SDK/Assemblies/ru/Microsoft.SqlServer.Types.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:ae:c2:0a:1f:39:f4:3f:98:d8:70:ae:77:0a:f4:ed:63:11:f1:c9
Signer

Actual PE Digest

19:ae:c2:0a:1f:39:f4:3f:98:d8:70:ae:77:0a:f4:ed:63:11:f1:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/Lib/x64/sqlncli11.lib
Bypass/EasyAnti/Lib/x86/sqlncli11.lib
Bypass/EasyAnti/Liberation.Configuration.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:cf:cd:30:5e:27:c7:9a:2a:07:92:c1:7a:5e:a1:3b:bd:d0:c2:44:e0:86:8e:87:17:f3:5e:b1:f5:97:b1:f8
Signer

Actual PE Digest

5c:cf:cd:30:5e:27:c7:9a:2a:07:92:c1:7a:5e:a1:3b:bd:d0:c2:44:e0:86:8e:87:17:f3:5e:b1:f5:97:b1:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\GitLab-Runner\builds\2e08d722\0\liberation\liberation\src\Liberation.Configuration\obj\Release\Liberation.Configuration.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/c7zip.dll
.dll windows:4 windows x64 arch:x64

e7355ec2d24e2656cdbd10fdae7817fb

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:f6:9c:5e:a4:8f:e7:9f:72:da:58:90:ed:17:b4:f1:de:41:a4:96:14:6d:9d:a5:ce:1e:38:c0:cf:5d:5d:c8
Signer

Actual PE Digest

42:f6:9c:5e:a4:8f:e7:9f:72:da:58:90:ed:17:b4:f1:de:41:a4:96:14:6d:9d:a5:ce:1e:38:c0:cf:5d:5d:c8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CompareFileTime
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetLastError
GetModuleFileNameW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fflush
fputc
free
fwrite
localeconv
malloc
memcmp
memcpy
memmove
memset
realloc
setlocale
strerror
strlen
strncmp
vfprintf
wcslen

oleaut32

SysAllocString
SysAllocStringLen
SysStringByteLen
VariantClear
VariantCopy

user32

CharUpperW

libgcc_s_seh-1

_Unwind_Resume

libstdc++-6

_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4sizeEv
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEixEy
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE4sizeEv
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5c_strEv
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5emptyEv
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5rfindEPKwy
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5rfindEwy
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6lengthEv
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6substrEyy
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7compareEPKw
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEixEy
_ZNKSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEE3strEv
_ZNKSt7__cxx1119basic_ostringstreamIwSt11char_traitsIwESaIwEE3strEv
_ZNSaIwEC1Ev
_ZNSaIwED1Ev
_ZNSt6localeC1EPKc
_ZNSt6localeC1ERKS_
_ZNSt6localeD1Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5clearEv
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6appendEPKw
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6appendERKS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EOS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EPKwRKS3_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EPKwyRKS3_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1ERKS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1Ev
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEaSEOS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEaSEPKw
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEaSERKS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEpLEPKw
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEpLEw
_ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEC1Ev
_ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEED1Ev
_ZNSt7__cxx1119basic_ostringstreamIwSt11char_traitsIwESaIwEEC1Ev
_ZNSt7__cxx1119basic_ostringstreamIwSt11char_traitsIwESaIwEED1Ev
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZNSt9basic_iosIcSt11char_traitsIcEE5imbueERKSt6locale
_ZNSt9basic_iosIwSt11char_traitsIwEE5imbueERKSt6locale
_ZSt17__throw_bad_allocv
_ZSt20__throw_length_errorPKc
_ZSt9use_facetISt5ctypeIcEERKT_RKSt6locale
_ZSt9use_facetISt5ctypeIwEERKT_RKSt6locale
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_c
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_S3_
_ZTIPKc
_ZTIi
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdaPv
_ZdlPv
_Znay
_Znwy
__cxa_allocate_exception
__cxa_begin_catch
__cxa_call_unexpected
__cxa_end_catch
__cxa_pure_virtual
__cxa_rethrow
__cxa_throw
__cxa_throw_bad_array_new_length
__dynamic_cast
__gxx_personality_seh0

Exports

Exports

ALL_POWERSCHEMES_GUID
DXVA2_ModeH264_A
DXVA2_ModeH264_B
DXVA2_ModeH264_C
DXVA2_ModeH264_D
DXVA2_ModeH264_E
DXVA2_ModeH264_F
DXVA2_ModeMPEG2_IDCT
DXVA2_ModeMPEG2_MoComp
DXVA2_ModeMPEG2_VLD
DXVA2_ModeVC1_A
DXVA2_ModeVC1_B
DXVA2_ModeVC1_C
DXVA2_ModeVC1_D
DXVA2_ModeWMV8_A
DXVA2_ModeWMV8_B
DXVA2_ModeWMV9_A
DXVA2_ModeWMV9_B
DXVA2_ModeWMV9_C
DXVA_NoEncrypt
GUID_ACDC_POWER_SOURCE
GUID_ACTIVE_POWERSCHEME
GUID_ADAPTIVE_POWER_BEHAVIOR_SUBGROUP
GUID_ALLOW_AWAYMODE
GUID_ALLOW_DISPLAY_REQUIRED
GUID_ALLOW_RTC_WAKE
GUID_ALLOW_STANDBY_STATES
GUID_ALLOW_SYSTEM_REQUIRED
GUID_APPLAUNCH_BUTTON
GUID_BACKGROUND_TASK_NOTIFICATION
GUID_BATTERY_DISCHARGE_ACTION_0
GUID_BATTERY_DISCHARGE_ACTION_1
GUID_BATTERY_DISCHARGE_ACTION_2
GUID_BATTERY_DISCHARGE_ACTION_3
GUID_BATTERY_DISCHARGE_FLAGS_0
GUID_BATTERY_DISCHARGE_FLAGS_1
GUID_BATTERY_DISCHARGE_FLAGS_2
GUID_BATTERY_DISCHARGE_FLAGS_3
GUID_BATTERY_DISCHARGE_LEVEL_0
GUID_BATTERY_DISCHARGE_LEVEL_1
GUID_BATTERY_DISCHARGE_LEVEL_2
GUID_BATTERY_DISCHARGE_LEVEL_3
GUID_BATTERY_PERCENTAGE_REMAINING
GUID_BATTERY_SUBGROUP
GUID_CONSOLE_DISPLAY_STATE
GUID_CRITICAL_POWER_TRANSITION
GUID_DEVICE_IDLE_POLICY
GUID_DEVICE_POWER_POLICY_VIDEO_BRIGHTNESS
GUID_DEVICE_POWER_POLICY_VIDEO_DIM_BRIGHTNESS
GUID_DEVINTERFACE_CDCHANGER
GUID_DEVINTERFACE_CDROM
GUID_DEVINTERFACE_COMPORT
GUID_DEVINTERFACE_DISK
GUID_DEVINTERFACE_FLOPPY
GUID_DEVINTERFACE_MEDIUMCHANGER
GUID_DEVINTERFACE_PARTITION
GUID_DEVINTERFACE_SERENUM_BUS_ENUMERATOR
GUID_DEVINTERFACE_STORAGEPORT
GUID_DEVINTERFACE_TAPE
GUID_DEVINTERFACE_VOLUME
GUID_DEVINTERFACE_WRITEONCEDISK
GUID_DISK_ADAPTIVE_POWERDOWN
GUID_DISK_BURST_IGNORE_THRESHOLD
GUID_DISK_COALESCING_POWERDOWN_TIMEOUT
GUID_DISK_IDLE_TIMEOUT
GUID_DISK_POWERDOWN_TIMEOUT
GUID_DISK_SUBGROUP
GUID_ENABLE_SWITCH_FORCED_SHUTDOWN
GUID_EXECUTION_REQUIRED_REQUEST_TIMEOUT
GUID_GLOBAL_USER_PRESENCE
GUID_HIBERNATE_FASTS4_POLICY
GUID_HIBERNATE_TIMEOUT
GUID_IDLE_BACKGROUND_TASK
GUID_IDLE_RESILIENCY_PERIOD
GUID_IDLE_RESILIENCY_SUBGROUP
GUID_LIDCLOSE_ACTION
GUID_LIDOPEN_POWERSTATE
GUID_LIDSWITCH_STATE_CHANGE
GUID_LOCK_CONSOLE_ON_WAKE
GUID_MAX_POWER_SAVINGS
GUID_MIN_POWER_SAVINGS
GUID_MONITOR_POWER_ON
GUID_NON_ADAPTIVE_INPUT_TIMEOUT
GUID_PCIEXPRESS_ASPM_POLICY
GUID_PCIEXPRESS_SETTINGS_SUBGROUP
GUID_POWERBUTTON_ACTION
GUID_POWERSCHEME_PERSONALITY
GUID_PROCESSOR_ALLOW_THROTTLING
GUID_PROCESSOR_CORE_PARKING_AFFINITY_HISTORY_DECREASE_FACTOR
GUID_PROCESSOR_CORE_PARKING_AFFINITY_HISTORY_THRESHOLD
GUID_PROCESSOR_CORE_PARKING_AFFINITY_WEIGHTING
GUID_PROCESSOR_CORE_PARKING_DECREASE_POLICY
GUID_PROCESSOR_CORE_PARKING_DECREASE_THRESHOLD
GUID_PROCESSOR_CORE_PARKING_DECREASE_TIME
GUID_PROCESSOR_CORE_PARKING_INCREASE_POLICY
GUID_PROCESSOR_CORE_PARKING_INCREASE_THRESHOLD
GUID_PROCESSOR_CORE_PARKING_INCREASE_TIME
GUID_PROCESSOR_CORE_PARKING_MAX_CORES
GUID_PROCESSOR_CORE_PARKING_MIN_CORES
GUID_PROCESSOR_CORE_PARKING_OVER_UTILIZATION_HISTORY_DECREASE_FACTOR
GUID_PROCESSOR_CORE_PARKING_OVER_UTILIZATION_HISTORY_THRESHOLD
GUID_PROCESSOR_CORE_PARKING_OVER_UTILIZATION_THRESHOLD
GUID_PROCESSOR_CORE_PARKING_OVER_UTILIZATION_WEIGHTING
GUID_PROCESSOR_DISTRIBUTE_UTILITY
GUID_PROCESSOR_IDLESTATE_POLICY
GUID_PROCESSOR_IDLE_ALLOW_SCALING
GUID_PROCESSOR_IDLE_DEMOTE_THRESHOLD
GUID_PROCESSOR_IDLE_DISABLE
GUID_PROCESSOR_IDLE_PROMOTE_THRESHOLD
GUID_PROCESSOR_IDLE_STATE_MAXIMUM
GUID_PROCESSOR_IDLE_TIME_CHECK
GUID_PROCESSOR_PARKING_CONCURRENCY_THRESHOLD
GUID_PROCESSOR_PARKING_CORE_OVERRIDE
GUID_PROCESSOR_PARKING_HEADROOM_THRESHOLD
GUID_PROCESSOR_PARKING_PERF_STATE
GUID_PROCESSOR_PERFSTATE_POLICY
GUID_PROCESSOR_PERF_BOOST_MODE
GUID_PROCESSOR_PERF_BOOST_POLICY
GUID_PROCESSOR_PERF_DECREASE_POLICY
GUID_PROCESSOR_PERF_DECREASE_THRESHOLD
GUID_PROCESSOR_PERF_DECREASE_TIME
GUID_PROCESSOR_PERF_HISTORY
GUID_PROCESSOR_PERF_INCREASE_POLICY
GUID_PROCESSOR_PERF_INCREASE_THRESHOLD
GUID_PROCESSOR_PERF_INCREASE_TIME
GUID_PROCESSOR_PERF_LATENCY_HINT
GUID_PROCESSOR_PERF_TIME_CHECK
GUID_PROCESSOR_SETTINGS_SUBGROUP
GUID_PROCESSOR_THROTTLE_MAXIMUM
GUID_PROCESSOR_THROTTLE_MINIMUM
GUID_PROCESSOR_THROTTLE_POLICY
GUID_SESSION_DISPLAY_STATUS
GUID_SESSION_USER_PRESENCE
GUID_SLEEPBUTTON_ACTION
GUID_SLEEP_IDLE_THRESHOLD
GUID_SLEEP_SUBGROUP
GUID_STANDBY_TIMEOUT
GUID_SYSTEM_AWAYMODE
GUID_SYSTEM_BUTTON_SUBGROUP
GUID_SYSTEM_COOLING_POLICY
GUID_TYPICAL_POWER_SAVINGS
GUID_UNATTEND_SLEEP_TIMEOUT
GUID_USERINTERFACEBUTTON_ACTION
GUID_VIDEO_ADAPTIVE_DISPLAY_BRIGHTNESS
GUID_VIDEO_ADAPTIVE_PERCENT_INCREASE
GUID_VIDEO_ADAPTIVE_POWERDOWN
GUID_VIDEO_ANNOYANCE_TIMEOUT
GUID_VIDEO_CONSOLE_LOCK_TIMEOUT
GUID_VIDEO_CURRENT_MONITOR_BRIGHTNESS
GUID_VIDEO_DIM_TIMEOUT
GUID_VIDEO_POWERDOWN_TIMEOUT
GUID_VIDEO_SUBGROUP
IID_AsyncIAdviseSink
IID_AsyncIAdviseSink2
IID_AsyncIMultiQI
IID_AsyncIUnknown
IID_IAddrExclusionControl
IID_IAddrTrackingControl
IID_IAdviseSink
IID_IAdviseSink2
IID_IAgileObject
IID_IAgileReference
IID_IApartmentShutdown
IID_IArchiveAllowTail
IID_IArchiveExtractCallback
IID_IArchiveExtractCallbackMessage
IID_IArchiveGetDiskProperty
IID_IArchiveGetRawProps
IID_IArchiveGetRootProps
IID_IArchiveKeepModeForNextOpen
IID_IArchiveOpenCallback
IID_IArchiveOpenSeq
IID_IArchiveOpenSetSubArchiveName
IID_IArchiveOpenVolumeCallback
IID_IArchiveUpdateCallback
IID_IArchiveUpdateCallback2
IID_IArchiveUpdateCallbackFile
IID_IAsyncManager
IID_IAsyncRpcChannelBuffer
IID_IAuthenticate
IID_IAuthenticateEx
IID_IBindCallbackRedirect
IID_IBindCtx
IID_IBindHost
IID_IBindProtocol
IID_IBindStatusCallback
IID_IBindStatusCallbackEx
IID_IBinding
IID_IBlockingLock
IID_ICallFactory
IID_ICancelMethodCalls
IID_ICatalogFileInfo
IID_IChannelHook
IID_IClassActivator
IID_IClassFactory
IID_IClientSecurity
IID_ICodeInstall
IID_IComThreadingInfo
IID_ICompressCodecsInfo
IID_ICompressCoder
IID_ICompressCoder2
IID_ICompressFilter
IID_ICompressGetInStreamProcessedSize
IID_ICompressGetInStreamProcessedSize2
IID_ICompressGetSubStreamSize
IID_ICompressInitEncoder
IID_ICompressProgressInfo
IID_ICompressReadUnusedFromInBuf
IID_ICompressSetBufSize
IID_ICompressSetCoderMt
IID_ICompressSetCoderProperties
IID_ICompressSetCoderPropertiesOpt
IID_ICompressSetDecoderProperties2
IID_ICompressSetFinishMode
IID_ICompressSetInStream
IID_ICompressSetInStream2
IID_ICompressSetMemLimit
IID_ICompressSetOutStream
IID_ICompressSetOutStreamSize
IID_ICompressWriteCoderProperties
IID_IContinue
IID_ICreateErrorInfo
IID_ICreateTypeInfo
IID_ICreateTypeInfo2
IID_ICreateTypeLib
IID_ICreateTypeLib2
IID_ICryptoGetTextPassword
IID_ICryptoGetTextPassword2
IID_ICryptoProperties
IID_ICryptoResetInitVector
IID_ICryptoSetCRC
IID_ICryptoSetPassword
IID_IDataAdviseHolder
IID_IDataFilter
IID_IDataObject
IID_IDirectWriterLock
IID_IDirectXVideoAccelerationService
IID_IDirectXVideoDecoderService
IID_IDispatch
IID_IDropSource
IID_IDropSourceNotify
IID_IDropTarget
IID_IDummyHICONIncluder
IID_IEncodingFilterFactory
IID_IEnumFORMATETC
IID_IEnumMoniker
IID_IEnumOLEVERB
IID_IEnumSTATDATA
IID_IEnumSTATPROPSETSTG
IID_IEnumSTATPROPSTG
IID_IEnumSTATSTG
IID_IEnumString
IID_IEnumUnknown
IID_IEnumVARIANT
IID_IErrorInfo
IID_IErrorLog
IID_IExternalConnection
IID_IFastRundown
IID_IFillLockBytes
IID_IForegroundTransfer
IID_IGetBindHandle
IID_IGlobalInterfaceTable
IID_IGlobalOptions
IID_IHasher
IID_IHashers
IID_IHttpNegotiate
IID_IHttpNegotiate2
IID_IHttpNegotiate3
IID_IHttpSecurity
IID_IInArchive
IID_IInArchiveGetStream
IID_IInStream
IID_IInitializeSpy
IID_IInternalUnknown
IID_IInternet
IID_IInternetBindInfo
IID_IInternetBindInfoEx
IID_IInternetHostSecurityManager
IID_IInternetPriority
IID_IInternetProtocol
IID_IInternetProtocolEx
IID_IInternetProtocolInfo
IID_IInternetProtocolRoot
IID_IInternetProtocolSink
IID_IInternetProtocolSinkStackable
IID_IInternetSecurityManager
IID_IInternetSecurityManagerEx
IID_IInternetSecurityManagerEx2
IID_IInternetSecurityMgrSite
IID_IInternetSession
IID_IInternetThreadSwitch
IID_IInternetZoneManager
IID_IInternetZoneManagerEx
IID_IInternetZoneManagerEx2
IID_ILayoutStorage
IID_ILockBytes
IID_IMalloc
IID_IMallocSpy
IID_IMarshal
IID_IMarshal2
IID_IMarshalingStream
IID_IMessageFilter
IID_IMoniker
IID_IMonikerProp
IID_IMultiQI
IID_INoMarshal
IID_IOleAdviseHolder
IID_IOleCache
IID_IOleCache2
IID_IOleCacheControl
IID_IOleClientSite
IID_IOleContainer
IID_IOleInPlaceActiveObject
IID_IOleInPlaceFrame
IID_IOleInPlaceObject
IID_IOleInPlaceSite
IID_IOleInPlaceUIWindow
IID_IOleItemContainer
IID_IOleLink
IID_IOleObject
IID_IOleWindow
IID_IOplockStorage
IID_IOutArchive
IID_IOutStream
IID_IOutStreamFinish
IID_IPSFactoryBuffer
IID_IParseDisplayName
IID_IPersist
IID_IPersistFile
IID_IPersistMoniker
IID_IPersistStorage
IID_IPersistStream
IID_IPipeByte
IID_IPipeDouble
IID_IPipeLong
IID_IPrintDialogCallback
IID_IPrintDialogServices
IID_IProcessInitControl
IID_IProcessLock
IID_IProgress
IID_IProgressNotify
IID_IPropertyBag
IID_IPropertySetStorage
IID_IPropertyStorage
IID_IROTData
IID_IRecordInfo
IID_IReleaseMarshalBuffers
IID_IRootStorage
IID_IRpcChannelBuffer
IID_IRpcChannelBuffer2
IID_IRpcChannelBuffer3
IID_IRpcHelper
IID_IRpcOptions
IID_IRpcProxyBuffer
IID_IRpcStubBuffer
IID_IRpcSyntaxNegotiate
IID_IRunnableObject
IID_IRunningObjectTable
IID_ISequentialInStream
IID_ISequentialOutStream
IID_ISequentialStream
IID_IServerSecurity
IID_IServiceProvider
IID_ISetCompressCodecsInfo
IID_ISetProperties
IID_ISoftDistExt
IID_IStdMarshalInfo
IID_IStorage
IID_IStream
IID_IStreamGetProps
IID_IStreamGetProps2
IID_IStreamGetSize
IID_ISupportErrorInfo
IID_ISurrogate
IID_ISurrogateService
IID_ISynchronize
IID_ISynchronizeContainer
IID_ISynchronizeEvent
IID_ISynchronizeHandle
IID_ISynchronizeMutex
IID_IThumbnailExtractor
IID_ITimeAndNoticeControl
IID_ITypeChangeEvents
IID_ITypeComp
IID_ITypeFactory
IID_ITypeInfo
IID_ITypeInfo2
IID_ITypeLib
IID_ITypeLib2
IID_ITypeMarshal
IID_IUnknown
IID_IUri
IID_IUriBuilder
IID_IUriBuilderFactory
IID_IUriContainer
IID_IUrlMon
IID_IViewObject
IID_IViewObject2
IID_IWaitMultiple
IID_IWinInetCacheHints
IID_IWinInetCacheHints2
IID_IWinInetFileStream
IID_IWinInetHttpInfo
IID_IWinInetHttpTimeouts
IID_IWinInetInfo
IID_IWindowForBindingUI
IID_IWrappedProtocol
IID_IZoneIdentifier
IsEqualGUID
NO_SUBGROUP_GUID
PPM_IDLESTATES_DATA_GUID
PPM_IDLESTATE_CHANGE_GUID
PPM_IDLE_ACCOUNTING_EX_GUID
PPM_IDLE_ACCOUNTING_GUID
PPM_PERFMON_PERFSTATE_GUID
PPM_PERFSTATES_DATA_GUID
PPM_PERFSTATE_CHANGE_GUID
PPM_PERFSTATE_DOMAIN_CHANGE_GUID
PPM_THERMALCONSTRAINT_GUID
PPM_THERMAL_POLICY_CHANGE_GUID
VIRTUAL_STORAGE_TYPE_VENDOR_MICROSOFT
VIRTUAL_STORAGE_TYPE_VENDOR_UNKNOWN
_Z10LoadCodecsP21_union_7zip_functionsR19C7ZipObjectPtrArray
_Z11FromCStringB5cxx11Pc
_Z11LoadFormatsP21_union_7zip_functionsR19C7ZipObjectPtrArray
_Z11MyCharUpperw
_Z11SplitStringRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEERSt6vectorIS4_SaIS4_EE
_Z11WidenStringRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_Z12NarrowStringRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z12ReadBoolPropPFjmP14tagPROPVARIANTEPFjjmS0_EjmRb
_Z12StringToBstrPKwPPw
_Z13Free7ZLibraryP11HINSTANCE__
_Z13GetCoderClassPFjjmP14tagPROPVARIANTEjmR5_GUIDRb
_Z13Load7ZLibraryRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z13Utf16_To_Utf8PcPKwS1_
_Z13Utf8_To_Utf16PwPyPKcS2_
_Z14GetFilePathExtRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEERS4_
_Z14GetHandlerPathB5cxx11Pv
_Z14ReadStringPropPFjmP14tagPROPVARIANTEPFjjmS0_EjmRNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z16GetLib7ZipLocalev
_Z16SetLib7ZipLocalePKc
_Z17Create7ZipArchiveP12C7ZipLibraryP10IInArchivePP12C7ZipArchiveRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z17IsArchiveItemAntiP10IInArchivejRb
_Z17IsArchiveItemPropP10IInArchivejmRb
_Z17LoadDllFromFolderP15C7ZipDllHandlerRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEER19C7ZipObjectPtrArray
_Z18GetArchiveItemPathP10IInArchivejRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEERS6_
_Z18GetArchiveItemPathP10IInArchivejRNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z18Lib7ZipOpenArchiveP12C7ZipLibraryP15C7ZipDllHandlerP13C7ZipInStreamPP12C7ZipArchiveRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEPlb
_Z18Utf16_To_Utf8_CalcPKwS0_
_Z18VARIANT_BOOLToBools
_Z19IsArchiveItemFolderP10IInArchivejRb
_Z21Create7ZipArchiveItemP12C7ZipArchiveP10IInArchivejPP16C7ZipArchiveItem
_Z21GetMethodPropertyGUIDPFjjmP14tagPROPVARIANTEjmR5_GUID
_Z21MyStringCompareNoCasePKwS0_
_Z22GetArchiveItemFileTimeP10IInArchivejRK9_FILETIMERS1_
_Z22NormalizeDirPathPrefixRNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z23GetMethodPropertyStringPFjjmP14tagPROPVARIANTEjmRNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_Z26ConvertPropVariantToUInt64RK14tagPROPVARIANT
_Z29Lib7ZipOpenMultiVolumeArchiveP12C7ZipLibraryP15C7ZipDllHandlerP17C7ZipMultiVolumesPP12C7ZipArchiveRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEPlb
_Z7fprintfP6_iobufPKcz
_Z8ReadPropPFjmP14tagPROPVARIANTEPFjjmS0_EjmRN8NWindows4NCOM12CPropVariantE
_Z9CheckUTF8PKcb
_Z9MyCompareIhEiT_S0_
_Z9MyCompareIlEiT_S0_
_Z9MyCompareImEiT_S0_
_Z9MyCompareIsEiT_S0_
_Z9MyCompareItEiT_S0_
_Z9MyCompareIxEiT_S0_
_Z9MyCompareIyEiT_S0_
_Z9ToCStringRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE
_ZN10CbInStream4ReadEPvjPj
_ZN10CbInStream4SeekExjPy
_ZN10CbInStream7GetSizeEPy
_ZN10CbInStream9CommitDefEv
_ZN10CbInStreamC1Ev
_ZN10CbInStreamD0Ev
_ZN10CbInStreamD1Ev
_ZN11C7ZipObjectC2Ev
_ZN11C7ZipObjectD0Ev
_ZN11C7ZipObjectD1Ev
_ZN11C7ZipObjectD2Ev
_ZN12C7ZipArchiveC1Ev
_ZN12C7ZipArchiveC2Ev
_ZN12C7ZipArchiveD0Ev
_ZN12C7ZipArchiveD1Ev
_ZN12C7ZipArchiveD2Ev
_ZN12C7ZipLibrary10GetVersionEv
_ZN12C7ZipLibrary10InitializeEv
_ZN12C7ZipLibrary11OpenArchiveEP13C7ZipInStreamPP12C7ZipArchiveRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEb
_ZN12C7ZipLibrary11OpenArchiveEP13C7ZipInStreamPP12C7ZipArchiveb
_ZN12C7ZipLibrary12DeinitializeEv
_ZN12C7ZipLibrary16GetSupportedExtsERSt6vectorINSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEESaIS6_EE
_ZN12C7ZipLibrary22OpenMultiVolumeArchiveEP17C7ZipMultiVolumesPP12C7ZipArchiveRKNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEb
_ZN12C7ZipLibrary22OpenMultiVolumeArchiveEP17C7ZipMultiVolumesPP12C7ZipArchiveb
_ZN12C7ZipLibrary23GetInternalObjectsArrayEv
_ZN12C7ZipLibraryC1Ev
_ZN12C7ZipLibraryC2Ev
_ZN12C7ZipLibraryD1Ev
_ZN12C7ZipLibraryD2Ev
_ZN13C7ZipInStreamC2Ev

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/grpc_csharp_ext.x64.dll
.dll windows:6 windows x64 arch:x64

7db324e992ecbd265ebcfed892d9a1db

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/11/2018, 00:00

Not After

17/11/2021, 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:c8:3f:db:c9:88:f8:10:a1:79:e6:fe:87:a8:04:86:3d:cf:ae:82:d4:e7:a6:e0:79:a4:94:36:22:55:97:13
Signer

Actual PE Digest

a1:c8:3f:db:c9:88:f8:10:a1:79:e6:fe:87:a8:04:86:3d:cf:ae:82:d4:e7:a6:e0:79:a4:94:36:22:55:97:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

T:\src\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb

Imports

wsock32

WSACleanup
WSAStartup
htons
htonl
connect
WSASetLastError
setsockopt
listen
getsockname
getpeername
WSAGetLastError
socket
closesocket
bind
ntohs
ntohl

ws2_32

WSASocketA
inet_pton
WSAIoctl
WSAGetOverlappedResult
getservbyport
recvfrom
__WSAFDIsSet
gethostname
inet_addr
getsockopt
ioctlsocket
send
recv
WSARecvFrom
WSAConnect
WSASend
WSARecv
freeaddrinfo
getaddrinfo
inet_ntop

kernel32

VirtualProtect
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
OutputDebugStringW
OutputDebugStringA
SetEndOfFile
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
CloseHandle
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
SetProcessAffinityMask
GetCurrentThreadId
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetCurrentProcessorNumber
GetSystemInfo
LocalFree
FormatMessageA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetLastError
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
TlsAlloc
TlsGetValue
TlsSetValue
RtlVirtualUnwind
FreeLibrary
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetVersionExA
GetTickCount
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
GetModuleHandleA
GetCurrentProcess
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
Sleep
GetCurrentProcessId
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureStackBackTrace
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
EncodePointer
DecodePointer
RaiseException
FormatMessageW
WideCharToMultiByte
TryEnterCriticalSection
DuplicateHandle
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
InitializeCriticalSectionAndSpinCount
TlsFree
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwindEx
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
ReadFile
GetTimeZoneInformation
SetFilePointerEx
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
HeapFree
HeapAlloc
ExitThread
ResumeThread
FreeLibraryAndExitThread
HeapReAlloc
SetConsoleCtrlHandler
GetACP
GetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetFullPathNameA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SystemFunction036
RegGetValueA
RegEnumKeyExA

dbghelp

SymInitialize
SymFromAddr
SymSetOptions

Exports

Exports

gprsharp_convert_clock_type
gprsharp_free
gprsharp_inf_future
gprsharp_inf_past
gprsharp_now
gprsharp_sizeof_timespec
grpcsharp_auth_context_peer_identity_property_name
grpcsharp_auth_context_property_iterator
grpcsharp_auth_context_release
grpcsharp_auth_property_iterator_next
grpcsharp_batch_context_create
grpcsharp_batch_context_destroy
grpcsharp_batch_context_recv_close_on_server_cancelled
grpcsharp_batch_context_recv_initial_metadata
grpcsharp_batch_context_recv_message_length
grpcsharp_batch_context_recv_message_next_slice_peek
grpcsharp_batch_context_recv_status_on_client_details
grpcsharp_batch_context_recv_status_on_client_error_string
grpcsharp_batch_context_recv_status_on_client_status
grpcsharp_batch_context_recv_status_on_client_trailing_metadata
grpcsharp_batch_context_reset
grpcsharp_call_auth_context
grpcsharp_call_cancel
grpcsharp_call_cancel_with_status
grpcsharp_call_credentials_release
grpcsharp_call_destroy
grpcsharp_call_get_peer
grpcsharp_call_recv_initial_metadata
grpcsharp_call_recv_message
grpcsharp_call_send_close_from_client
grpcsharp_call_send_initial_metadata
grpcsharp_call_send_message
grpcsharp_call_send_status_from_server
grpcsharp_call_set_credentials
grpcsharp_call_start_client_streaming
grpcsharp_call_start_duplex_streaming
grpcsharp_call_start_server_streaming
grpcsharp_call_start_serverside
grpcsharp_call_start_unary
grpcsharp_channel_args_create
grpcsharp_channel_args_destroy
grpcsharp_channel_args_set_integer
grpcsharp_channel_args_set_string
grpcsharp_channel_check_connectivity_state
grpcsharp_channel_create_call
grpcsharp_channel_credentials_release
grpcsharp_channel_destroy
grpcsharp_channel_get_target
grpcsharp_channel_watch_connectivity_state
grpcsharp_completion_queue_create_async
grpcsharp_completion_queue_create_sync
grpcsharp_completion_queue_destroy
grpcsharp_completion_queue_next
grpcsharp_completion_queue_pluck
grpcsharp_completion_queue_shutdown
grpcsharp_composite_call_credentials_create
grpcsharp_composite_channel_credentials_create
grpcsharp_init
grpcsharp_insecure_channel_create
grpcsharp_metadata_array_add
grpcsharp_metadata_array_count
grpcsharp_metadata_array_create
grpcsharp_metadata_array_destroy_full
grpcsharp_metadata_array_get_key
grpcsharp_metadata_array_get_value
grpcsharp_metadata_credentials_create_from_plugin
grpcsharp_metadata_credentials_notify_from_plugin
grpcsharp_native_callback_dispatcher_init
grpcsharp_override_default_ssl_roots
grpcsharp_redirect_log
grpcsharp_request_call_context_call
grpcsharp_request_call_context_create
grpcsharp_request_call_context_deadline
grpcsharp_request_call_context_destroy
grpcsharp_request_call_context_host
grpcsharp_request_call_context_method
grpcsharp_request_call_context_request_metadata
grpcsharp_request_call_context_reset
grpcsharp_secure_channel_create
grpcsharp_server_add_insecure_http2_port
grpcsharp_server_add_secure_http2_port
grpcsharp_server_cancel_all_calls
grpcsharp_server_create
grpcsharp_server_credentials_release
grpcsharp_server_destroy
grpcsharp_server_register_completion_queue
grpcsharp_server_request_call
grpcsharp_server_shutdown_and_notify_callback
grpcsharp_server_start
grpcsharp_shutdown
grpcsharp_sizeof_grpc_event
grpcsharp_slice_buffer_adjust_tail_space
grpcsharp_slice_buffer_create
grpcsharp_slice_buffer_destroy
grpcsharp_slice_buffer_reset_and_unref
grpcsharp_slice_buffer_slice_count
grpcsharp_slice_buffer_slice_peek
grpcsharp_ssl_credentials_create
grpcsharp_ssl_server_credentials_create
grpcsharp_test_call_start_unary_echo
grpcsharp_test_callback
grpcsharp_test_nop
grpcsharp_test_override_method
grpcsharp_version_string

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/libgcc_s_seh-1.dll
.dll windows:4 windows x64 arch:x64

8142ee0f45e10ebbff675b18dc67c93c

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:35:89:b9:2c:50:d9:3c:d5:a9:ed:a2:e8:5d:ff:44:c9:c3:de:bb:52:85:a0:d6:28:60:15:28:f4:2f:1b:7f
Signer

Actual PE Digest

69:35:89:b9:2c:50:d9:3c:d5:a9:ed:a2:e8:5d:ff:44:c9:c3:de:bb:52:85:a0:d6:28:60:15:28:f4:2f:1b:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
malloc
memcpy
memset
realloc
strlen
strncmp
vfprintf

libwinpthread-1

pthread_getspecific
pthread_key_create
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_once
pthread_setspecific

Exports

Exports

_GCC_specific_handler
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__absvdi2
__absvsi2
__absvti2
__addtf3
__addvdi3
__addvsi3
__addvti3
__ashlti3
__ashrti3
__bswapdi2
__bswapsi2
__clear_cache
__clrsbdi2
__clrsbti2
__clzdi2
__clzti2
__cmpti2
__ctzdi2
__ctzti2
__divdc3
__divmodti4
__divsc3
__divtc3
__divtf3
__divti3
__divxc3
__emutls_get_address
__emutls_register_common
__enable_execute_stack
__eqtf2
__extenddftf2
__extendsfdf2
__extendsftf2
__extendxftf2
__ffsdi2
__ffsti2
__fixdfti
__fixsfti
__fixtfdi
__fixtfsi
__fixtfti
__fixunsdfdi
__fixunsdfti
__fixunssfdi
__fixunssfti
__fixunstfdi
__fixunstfsi
__fixunstfti
__fixunsxfdi
__fixunsxfti
__fixxfti
__floatditf
__floatsitf
__floattidf
__floattisf
__floattitf
__floattixf
__floatunditf
__floatunsitf
__floatuntidf
__floatuntisf
__floatuntitf
__floatuntixf
__gcc_personality_seh0
__getf2
__gttf2
__letf2
__lshrti3
__lttf2
__modti3
__muldc3
__mulsc3
__multc3
__multf3
__multi3
__mulvdi3
__mulvsi3
__mulvti3
__mulxc3
__negtf2
__negti2
__negvdi2
__negvsi2
__negvti2
__netf2
__paritydi2
__parityti2
__popcountdi2
__popcountti2
__powidf2
__powisf2
__powitf2
__powixf2
__subtf3
__subvdi3
__subvsi3
__subvti3
__truncdfsf2
__trunctfdf2
__trunctfsf2
__trunctfxf2
__ucmpti2
__udivmodti4
__udivti3
__umodti3
__unordtf2

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 336B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/libmangler.dll
.dll windows:6 windows x64 arch:x64

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:24:20:27:6e:2e:14:f9:b1:2c:ca:03:a6:b0:60:65:b7:7d:6d:3a:d7:a1:78:87:ec:81:99:ee:a8:10:3b:30
Signer

Actual PE Digest

ed:24:20:27:6e:2e:14:f9:b1:2c:ca:03:a6:b0:60:65:b7:7d:6d:3a:d7:a1:78:87:ec:81:99:ee:a8:10:3b:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

LibMangler_Categories_Get
LibMangler_Categories_SetEnable
LibMangler_DisableErrorLogging
LibMangler_DisableExtendedErrorLogging
LibMangler_DisableTokenSelfHealing
LibMangler_EnableErrorLogging
LibMangler_EnableExtendedErrorLogging
LibMangler_EnableTokenSelfHealing
LibMangler_Exit
LibMangler_Free
LibMangler_GenerateCertificate
LibMangler_GetProxyPort
LibMangler_Init
LibMangler_SetEndpoint
LibMangler_SetLang
LibMangler_SetNotificationsCallback
LibMangler_SetNotificationsDelay
LibMangler_SetRenewTokenCallback
LibMangler_SetReporterCallbackLevel
LibMangler_SetToken
LibMangler_Start
LibMangler_Stats_Clear
LibMangler_Stats_ClearBlockedAttempts
LibMangler_Stats_ClearOne
LibMangler_Stats_ClearTTL
LibMangler_Stats_GetBlockedAdsAndTrackersCount
LibMangler_Stats_GetRefererInfo
LibMangler_Stats_GetReferers
LibMangler_Stats_GetReferersInfo
LibMangler_Stats_IsReferersInfoUpdated
LibMangler_Stop
LibMangler_UserFilter_Clear
LibMangler_UserFilter_ClearOne
LibMangler_UserFilter_SetNarrow
LibMangler_UserFilter_SetWide
LibMangler_UserFilter_UpdateAllNarrowForReferrer
LibMangler_VerifyCA
LibMangler_Version
_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
doneTrampoline
lokiGetWarningPage
lokiLog
lokiNotification
lokiOnRequest
lokiOnResponse
preUpdateHookTrampoline
rollbackHookTrampoline
stepTrampoline
threatprotectionapp_call_close_cb
threatprotectionapp_call_configure_cb
threatprotectionapp_call_error_cb
threatprotectionapp_call_init_cb
threatprotectionapp_call_send_events_cb
threatprotectionapp_call_send_log_cb
updateHookTrampoline

Sections

UPX0
Size: - Virtual size: 8.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 873KB - Virtual size: 873KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 439KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/libstdc++-6.dll
.dll windows:4 windows x64 arch:x64

58ed1f524a393a648af84da9e191f638

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:bc:47:34:1f:db:86:23:a3:54:55:17:0d:cf:9c:be:b7:14:c3:2b:32:08:a2:cb:16:49:e7:69:ba:58:92:44
Signer

Actual PE Digest

b0:bc:47:34:1f:db:86:23:a3:54:55:17:0d:cf:9c:be:b7:14:c3:2b:32:08:a2:cb:16:49:e7:69:ba:58:92:44

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libgcc_s_seh-1

_GCC_specific_handler
_Unwind_DeleteException
_Unwind_GetDataRelBase
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__emutls_get_address
__popcountdi2
__udivti3

kernel32

CloseHandle
CreateFileW
CreateHardLinkW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FormatMessageA
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTempPathW
GetTimeZoneInformation
GetVolumeInformationW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileExW
MultiByteToWideChar
RemoveDirectoryW
SetEndOfFile
SetFilePointer
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_aligned_free
_aligned_malloc
_amsg_exit
_assert
_close
_close
_errno
_fdopen
_filelengthi64
_fileno
_findclose
_fileno
_fstat64
_get_osfhandle
_initterm
_lock
_lseeki64
_read
_telli64
_unlock
_wchdir
_wchmod
_wfindfirst64
_wfindnext64
_wfopen
_wfullpath
_wgetcwd
_wmkdir
_wopen
_wstat64
_wutime64
abort
calloc
fclose
fflush
fgetpos
fopen
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isspace
iswctype
_write
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
realloc
setlocale
setvbuf
sprintf
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strstr
strtoul
strxfrm
towlower
towupper
ungetc
vfprintf
ungetwc
wcscat
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsxfrm

libwinpthread-1

clock_gettime
nanosleep
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_signal
pthread_cond_wait
pthread_create
pthread_detach
pthread_getspecific
pthread_join
pthread_key_create
pthread_key_delete
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_num_processors_np
pthread_once
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_setspecific

Exports

Exports

_Z7fprintfP6_iobufPKcz
_Z7sprintfPcPKcz
_ZGTtNKSt13bad_exception4whatEv
_ZGTtNKSt13bad_exceptionD1Ev
_ZGTtNKSt9exception4whatEv
_ZGTtNKSt9exceptionD1Ev
_ZGVN9__gnu_cxx16bitmap_allocatorIcE13_S_mem_blocksE
_ZGVN9__gnu_cxx16bitmap_allocatorIcE15_S_last_requestE
_ZGVN9__gnu_cxx16bitmap_allocatorIcE6_S_mutE
_ZGVN9__gnu_cxx16bitmap_allocatorIwE13_S_mem_blocksE
_ZGVN9__gnu_cxx16bitmap_allocatorIwE15_S_last_requestE
_ZGVN9__gnu_cxx16bitmap_allocatorIwE6_S_mutE
_ZGVNSt10moneypunctIcLb0EE2idE
_ZGVNSt10moneypunctIcLb1EE2idE
_ZGVNSt10moneypunctIwLb0EE2idE
_ZGVNSt10moneypunctIwLb1EE2idE
_ZGVNSt11__timepunctIcE2idE
_ZGVNSt11__timepunctIwE2idE
_ZGVNSt7__cxx1110moneypunctIcLb0EE2idE
_ZGVNSt7__cxx1110moneypunctIcLb1EE2idE
_ZGVNSt7__cxx1110moneypunctIwLb0EE2idE
_ZGVNSt7__cxx1110moneypunctIwLb1EE2idE
_ZGVNSt7__cxx117collateIcE2idE
_ZGVNSt7__cxx117collateIwE2idE
_ZGVNSt7__cxx118messagesIcE2idE
_ZGVNSt7__cxx118messagesIwE2idE
_ZGVNSt7__cxx118numpunctIcE2idE
_ZGVNSt7__cxx118numpunctIwE2idE
_ZGVNSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt7__cxx119money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt7__cxx119money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt7__cxx119money_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt7__cxx119money_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt7collateIcE2idE
_ZGVNSt7collateIwE2idE
_ZGVNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt7num_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt8messagesIcE2idE
_ZGVNSt8messagesIwE2idE
_ZGVNSt8numpunctIcE2idE
_ZGVNSt8numpunctIwE2idE
_ZGVNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt8time_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt9money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt9money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVNSt9money_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE
_ZGVNSt9money_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE2idE
_ZGVZN9__gnu_cxx13__common_poolINS_6__poolELb1EE11_S_get_poolEvE7_S_pool
_ZGVZN9__gnu_cxx9free_list12_M_get_mutexEvE8_S_mutex
_ZGVZN9__gnu_cxx9free_list16_M_get_free_listEvE12_S_free_list
_ZN10__cxxabiv111__terminateEPFvvE
_ZN10__cxxabiv112__unexpectedEPFvvE
_ZN10__cxxabiv115__forced_unwindD0Ev
_ZN10__cxxabiv115__forced_unwindD1Ev
_ZN10__cxxabiv115__forced_unwindD2Ev
_ZN10__cxxabiv116__enum_type_infoD0Ev
_ZN10__cxxabiv116__enum_type_infoD1Ev
_ZN10__cxxabiv116__enum_type_infoD2Ev
_ZN10__cxxabiv117__array_type_infoD0Ev
_ZN10__cxxabiv117__array_type_infoD1Ev
_ZN10__cxxabiv117__array_type_infoD2Ev
_ZN10__cxxabiv117__class_type_infoD0Ev
_ZN10__cxxabiv117__class_type_infoD1Ev
_ZN10__cxxabiv117__class_type_infoD2Ev
_ZN10__cxxabiv117__pbase_type_infoD0Ev
_ZN10__cxxabiv117__pbase_type_infoD1Ev
_ZN10__cxxabiv117__pbase_type_infoD2Ev
_ZN10__cxxabiv119__foreign_exceptionD0Ev
_ZN10__cxxabiv119__foreign_exceptionD1Ev
_ZN10__cxxabiv119__foreign_exceptionD2Ev
_ZN10__cxxabiv119__pointer_type_infoD0Ev
_ZN10__cxxabiv119__pointer_type_infoD1Ev
_ZN10__cxxabiv119__pointer_type_infoD2Ev
_ZN10__cxxabiv119__terminate_handlerE
_ZN10__cxxabiv120__function_type_infoD0Ev
_ZN10__cxxabiv120__function_type_infoD1Ev
_ZN10__cxxabiv120__function_type_infoD2Ev
_ZN10__cxxabiv120__si_class_type_infoD0Ev
_ZN10__cxxabiv120__si_class_type_infoD1Ev
_ZN10__cxxabiv120__si_class_type_infoD2Ev
_ZN10__cxxabiv120__unexpected_handlerE
_ZN10__cxxabiv121__vmi_class_type_infoD0Ev
_ZN10__cxxabiv121__vmi_class_type_infoD1Ev
_ZN10__cxxabiv121__vmi_class_type_infoD2Ev
_ZN10__cxxabiv123__fundamental_type_infoD0Ev
_ZN10__cxxabiv123__fundamental_type_infoD1Ev
_ZN10__cxxabiv123__fundamental_type_infoD2Ev
_ZN10__cxxabiv129__pointer_to_member_type_infoD0Ev
_ZN10__cxxabiv129__pointer_to_member_type_infoD1Ev
_ZN10__cxxabiv129__pointer_to_member_type_infoD2Ev
_ZN11__gnu_debug19_Safe_iterator_base12_M_get_mutexEv
_ZN11__gnu_debug19_Safe_iterator_base16_M_attach_singleEPNS_19_Safe_sequence_baseEb
_ZN11__gnu_debug19_Safe_iterator_base16_M_detach_singleEv
_ZN11__gnu_debug19_Safe_iterator_base8_M_resetEv
_ZN11__gnu_debug19_Safe_iterator_base9_M_attachEPNS_19_Safe_sequence_baseEb
_ZN11__gnu_debug19_Safe_iterator_base9_M_detachEv
_ZN11__gnu_debug19_Safe_sequence_base12_M_get_mutexEv
_ZN11__gnu_debug19_Safe_sequence_base13_M_detach_allEv
_ZN11__gnu_debug19_Safe_sequence_base16_M_attach_singleEPNS_19_Safe_iterator_baseEb
_ZN11__gnu_debug19_Safe_sequence_base16_M_detach_singleEPNS_19_Safe_iterator_baseE
_ZN11__gnu_debug19_Safe_sequence_base18_M_detach_singularEv
_ZN11__gnu_debug19_Safe_sequence_base22_M_revalidate_singularEv
_ZN11__gnu_debug19_Safe_sequence_base7_M_swapERS0_
_ZN11__gnu_debug19_Safe_sequence_base9_M_attachEPNS_19_Safe_iterator_baseEb
_ZN11__gnu_debug19_Safe_sequence_base9_M_detachEPNS_19_Safe_iterator_baseE
_ZN11__gnu_debug25_Safe_local_iterator_base16_M_attach_singleEPNS_19_Safe_sequence_baseEb
_ZN11__gnu_debug25_Safe_local_iterator_base16_M_detach_singleEv
_ZN11__gnu_debug25_Safe_local_iterator_base9_M_attachEPNS_19_Safe_sequence_baseEb
_ZN11__gnu_debug25_Safe_local_iterator_base9_M_detachEv
_ZN11__gnu_debug30_Safe_unordered_container_base13_M_detach_allEv
_ZN11__gnu_debug30_Safe_unordered_container_base15_M_attach_localEPNS_19_Safe_iterator_baseEb
_ZN11__gnu_debug30_Safe_unordered_container_base15_M_detach_localEPNS_19_Safe_iterator_baseE
_ZN11__gnu_debug30_Safe_unordered_container_base22_M_attach_local_singleEPNS_19_Safe_iterator_baseEb
_ZN11__gnu_debug30_Safe_unordered_container_base22_M_detach_local_singleEPNS_19_Safe_iterator_baseE
_ZN11__gnu_debug30_Safe_unordered_container_base7_M_swapERS0_
_ZN14__gnu_internal12buf_cin_syncE
_ZN14__gnu_internal13buf_cerr_syncE
_ZN14__gnu_internal13buf_cout_syncE
_ZN14__gnu_internal13buf_wcin_syncE
_ZN14__gnu_internal14buf_wcerr_syncE
_ZN14__gnu_internal14buf_wcout_syncE
_ZN14__gnu_internal7buf_cinE
_ZN14__gnu_internal8buf_cerrE
_ZN14__gnu_internal8buf_coutE
_ZN14__gnu_internal8buf_wcinE
_ZN14__gnu_internal9buf_wcerrE
_ZN14__gnu_internal9buf_wcoutE
_ZN14__gnu_internal9get_mutexEh
_ZN14__gnu_parallel9_Settings3getEv
_ZN14__gnu_parallel9_Settings3setERS0_
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEE10deallocateEPcy
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEE14_M_get_optionsEv
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEE14_M_set_optionsENS_11__pool_base5_TuneE
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEE8allocateEyPKv
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEEC1ERKS4_
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEEC1Ev
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEEC2ERKS4_
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEEC2Ev
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEED1Ev
_ZN9__gnu_cxx10__mt_allocIcNS_20__common_pool_policyINS_6__poolELb1EEEED2Ev
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEE10deallocateEPwy
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEE14_M_get_optionsEv
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEE14_M_set_optionsENS_11__pool_base5_TuneE
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEE8allocateEyPKv
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEEC1ERKS4_
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEEC1Ev
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEEC2ERKS4_
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEEC2Ev
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEED1Ev
_ZN9__gnu_cxx10__mt_allocIwNS_20__common_pool_policyINS_6__poolELb1EEEED2Ev
_ZN9__gnu_cxx12__atomic_addEPVii
_ZN9__gnu_cxx12__pool_allocIcE10deallocateEPcy
_ZN9__gnu_cxx12__pool_allocIcE12_S_force_newE
_ZN9__gnu_cxx12__pool_allocIcE7destroyEPc
_ZN9__gnu_cxx12__pool_allocIcE8allocateEyPKv
_ZN9__gnu_cxx12__pool_allocIcE9constructEPcRKc
_ZN9__gnu_cxx12__pool_allocIcEC1ERKS1_
_ZN9__gnu_cxx12__pool_allocIcEC1Ev
_ZN9__gnu_cxx12__pool_allocIcEC2ERKS1_
_ZN9__gnu_cxx12__pool_allocIcEC2Ev
_ZN9__gnu_cxx12__pool_allocIcED1Ev
_ZN9__gnu_cxx12__pool_allocIcED2Ev
_ZN9__gnu_cxx12__pool_allocIwE10deallocateEPwy
_ZN9__gnu_cxx12__pool_allocIwE12_S_force_newE
_ZN9__gnu_cxx12__pool_allocIwE7destroyEPw
_ZN9__gnu_cxx12__pool_allocIwE8allocateEyPKv
_ZN9__gnu_cxx12__pool_allocIwE9constructEPwRKw
_ZN9__gnu_cxx12__pool_allocIwEC1ERKS1_
_ZN9__gnu_cxx12__pool_allocIwEC1Ev
_ZN9__gnu_cxx12__pool_allocIwEC2ERKS1_
_ZN9__gnu_cxx12__pool_allocIwEC2Ev
_ZN9__gnu_cxx12__pool_allocIwED1Ev
_ZN9__gnu_cxx12__pool_allocIwED2Ev
_ZN9__gnu_cxx13__scoped_lockD1Ev
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEE2fdEv
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEE4fileEv
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEE4swapERS3_
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEC1EP6_iobufSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEC1EiSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEC1Ev
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEC2EP6_iobufSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEC2EiSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEC2Ev
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEED0Ev
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEED1Ev
_ZN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEED2Ev
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEE2fdEv
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEE4fileEv
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEE4swapERS3_
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEEC1EP6_iobufSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEEC1EiSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEEC1Ev
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEEC2EP6_iobufSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEEC2EiSt13_Ios_Openmodey
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEEC2Ev
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEED0Ev
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEED1Ev
_ZN9__gnu_cxx13stdio_filebufIwSt11char_traitsIwEED2Ev
_ZN9__gnu_cxx15__concat_size_tEPcyy
_ZN9__gnu_cxx15__snprintf_liteEPcyPKcS0_
_ZN9__gnu_cxx16bitmap_allocatorIcE10deallocateEPcy
_ZN9__gnu_cxx16bitmap_allocatorIcE13_S_block_sizeE
_ZN9__gnu_cxx16bitmap_allocatorIcE13_S_mem_blocksE
_ZN9__gnu_cxx16bitmap_allocatorIcE14_S_refill_poolEv
_ZN9__gnu_cxx16bitmap_allocatorIcE15_S_last_requestE
_ZN9__gnu_cxx16bitmap_allocatorIcE21_S_last_dealloc_indexE
_ZN9__gnu_cxx16bitmap_allocatorIcE25_M_allocate_single_objectEv
_ZN9__gnu_cxx16bitmap_allocatorIcE27_M_deallocate_single_objectEPc
_ZN9__gnu_cxx16bitmap_allocatorIcE6_S_mutE
_ZN9__gnu_cxx16bitmap_allocatorIcE7destroyEPc
_ZN9__gnu_cxx16bitmap_allocatorIcE8allocateEy
_ZN9__gnu_cxx16bitmap_allocatorIcE8allocateEyPKv
_ZN9__gnu_cxx16bitmap_allocatorIcE9constructEPcRKc
_ZN9__gnu_cxx16bitmap_allocatorIcEC1ERKS1_
_ZN9__gnu_cxx16bitmap_allocatorIcEC1Ev
_ZN9__gnu_cxx16bitmap_allocatorIcEC2ERKS1_
_ZN9__gnu_cxx16bitmap_allocatorIcEC2Ev
_ZN9__gnu_cxx16bitmap_allocatorIcED1Ev
_ZN9__gnu_cxx16bitmap_allocatorIcED2Ev
_ZN9__gnu_cxx16bitmap_allocatorIwE10deallocateEPwy
_ZN9__gnu_cxx16bitmap_allocatorIwE13_S_block_sizeE
_ZN9__gnu_cxx16bitmap_allocatorIwE13_S_mem_blocksE
_ZN9__gnu_cxx16bitmap_allocatorIwE14_S_refill_poolEv
_ZN9__gnu_cxx16bitmap_allocatorIwE15_S_last_requestE
_ZN9__gnu_cxx16bitmap_allocatorIwE21_S_last_dealloc_indexE
_ZN9__gnu_cxx16bitmap_allocatorIwE25_M_allocate_single_objectEv
_ZN9__gnu_cxx16bitmap_allocatorIwE27_M_deallocate_single_objectEPw
_ZN9__gnu_cxx16bitmap_allocatorIwE6_S_mutE
_ZN9__gnu_cxx16bitmap_allocatorIwE7destroyEPw
_ZN9__gnu_cxx16bitmap_allocatorIwE8allocateEy
_ZN9__gnu_cxx16bitmap_allocatorIwE8allocateEyPKv
_ZN9__gnu_cxx16bitmap_allocatorIwE9constructEPwRKw
_ZN9__gnu_cxx16bitmap_allocatorIwEC1ERKS1_
_ZN9__gnu_cxx16bitmap_allocatorIwEC1Ev
_ZN9__gnu_cxx16bitmap_allocatorIwEC2ERKS1_
_ZN9__gnu_cxx16bitmap_allocatorIwEC2Ev
_ZN9__gnu_cxx16bitmap_allocatorIwED1Ev
_ZN9__gnu_cxx16bitmap_allocatorIwED2Ev
_ZN9__gnu_cxx17__pool_alloc_base11_S_end_freeE
_ZN9__gnu_cxx17__pool_alloc_base12_M_get_mutexEv
_ZN9__gnu_cxx17__pool_alloc_base12_S_free_listE
_ZN9__gnu_cxx17__pool_alloc_base12_S_heap_sizeE
_ZN9__gnu_cxx17__pool_alloc_base13_S_start_freeE
_ZN9__gnu_cxx17__pool_alloc_base16_M_get_free_listEy
_ZN9__gnu_cxx17__pool_alloc_base17_M_allocate_chunkEyRi
_ZN9__gnu_cxx17__pool_alloc_base9_M_refillEy
_ZN9__gnu_cxx18__common_pool_baseINS_6__poolELb1EE13_S_initializeEv
_ZN9__gnu_cxx18__exchange_and_addEPVii
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE4fileEv
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE4swapERS3_
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE4syncEv
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE5uflowEv
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE6xsgetnEPcx
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE6xsputnEPKcx
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE7seekoffExSt12_Ios_SeekdirSt13_Ios_Openmode
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE7seekposESt4fposIiESt13_Ios_Openmode
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE8overflowEi
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE9pbackfailEi
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEE9underflowEv
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEEC1EOS3_
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEEC1EP6_iobuf
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEEC2EOS3_
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEEC2EP6_iobuf
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEED0Ev
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEED1Ev
_ZN9__gnu_cxx18stdio_sync_filebufIcSt11char_traitsIcEEaSEOS3_
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE4fileEv
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE4swapERS3_
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE4syncEv
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE5uflowEv
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE6xsgetnEPwx
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE6xsputnEPKwx
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE7seekoffExSt12_Ios_SeekdirSt13_Ios_Openmode
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE7seekposESt4fposIiESt13_Ios_Openmode
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE8overflowEt
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE9pbackfailEt
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEE9underflowEv
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEEC1EOS3_
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEEC1EP6_iobuf
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEEC2EOS3_
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEEC2EP6_iobuf
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEED0Ev
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEED1Ev
_ZN9__gnu_cxx18stdio_sync_filebufIwSt11char_traitsIwEEaSEOS3_
_ZN9__gnu_cxx19__function_requiresINS_19_ConvertibleConceptIjjEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_21_InputIteratorConceptIPKcEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_21_InputIteratorConceptIPKwEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_21_InputIteratorConceptIPcEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_21_InputIteratorConceptIPwEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_22_OutputIteratorConceptISt19ostreambuf_iteratorIcSt11char_traitsIcEEcEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_22_OutputIteratorConceptISt19ostreambuf_iteratorIwSt11char_traitsIwEEwEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_26_LessThanComparableConceptIPcEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_26_LessThanComparableConceptIPwEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_26_LessThanComparableConceptIiEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_26_LessThanComparableConceptIjEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_26_LessThanComparableConceptIlEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_26_LessThanComparableConceptIxEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptINS_17__normal_iteratorIPKcSsEEEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptINS_17__normal_iteratorIPKwSbIwSt11char_traitsIwESaIwEEEEEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptINS_17__normal_iteratorIPcSsEEEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptINS_17__normal_iteratorIPwSbIwSt11char_traitsIwESaIwEEEEEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptIPKcEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptIPKwEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptIPcEEEEvv
_ZN9__gnu_cxx19__function_requiresINS_28_RandomAccessIteratorConceptIPwEEEEvv
_ZN9__gnu_cxx20recursive_init_errorC1Ev
_ZN9__gnu_cxx20recursive_init_errorC2Ev
_ZN9__gnu_cxx20recursive_init_errorD0Ev
_ZN9__gnu_cxx20recursive_init_errorD1Ev
_ZN9__gnu_cxx20recursive_init_errorD2Ev
_ZN9__gnu_cxx24__concurrence_lock_errorD0Ev
_ZN9__gnu_cxx24__concurrence_lock_errorD1Ev
_ZN9__gnu_cxx24__concurrence_wait_errorD0Ev
_ZN9__gnu_cxx24__concurrence_wait_errorD1Ev
_ZN9__gnu_cxx26__aux_require_boolean_exprIbEEvRKT_
_ZN9__gnu_cxx26__concurrence_unlock_errorD0Ev
_ZN9__gnu_cxx26__concurrence_unlock_errorD1Ev
_ZN9__gnu_cxx26__throw_insufficient_spaceEPKcS1_
_ZN9__gnu_cxx27__verbose_terminate_handlerEv
_ZN9__gnu_cxx29__concurrence_broadcast_errorD0Ev
_ZN9__gnu_cxx29__concurrence_broadcast_errorD1Ev
_ZN9__gnu_cxx30__throw_concurrence_lock_errorEv
_ZN9__gnu_cxx32__throw_concurrence_unlock_errorEv
_ZN9__gnu_cxx35__throw_concurrence_broadcast_errorEv
_ZN9__gnu_cxx4ropeIcSaIcEE10_S_min_lenE
_ZN9__gnu_cxx4ropeIcSaIcEE8_S_fetchEPNS_13_Rope_RopeRepIcS1_EEy
_ZN9__gnu_cxx4ropeIwSaIwEE10_S_min_lenE
_ZN9__gnu_cxx4ropeIwSaIwEE8_S_fetchEPNS_13_Rope_RopeRepIwS1_EEy
_ZN9__gnu_cxx6__poolILb0EE10_M_destroyEv
_ZN9__gnu_cxx6__poolILb0EE13_M_initializeEv
_ZN9__gnu_cxx6__poolILb0EE16_M_reclaim_blockEPcy
_ZN9__gnu_cxx6__poolILb0EE16_M_reserve_blockEyy
_ZN9__gnu_cxx6__poolILb1EE10_M_destroyEv
_ZN9__gnu_cxx6__poolILb1EE13_M_initializeEPFvPvE
_ZN9__gnu_cxx6__poolILb1EE13_M_initializeEv
_ZN9__gnu_cxx6__poolILb1EE16_M_get_thread_idEv
_ZN9__gnu_cxx6__poolILb1EE16_M_reclaim_blockEPcy
_ZN9__gnu_cxx6__poolILb1EE16_M_reserve_blockEyy
_ZN9__gnu_cxx6__poolILb1EE21_M_destroy_thread_keyEPv
_ZN9__gnu_cxx8__detail13__lower_boundIPPyyNS_9free_list19_LT_pointer_compareEEET_S6_S6_RKT0_T1_
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE10deallocateEPS2_y
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE5clearEv
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE5eraseEPS2_
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE6insertEPS2_RKS2_
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE8allocateEy
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE8pop_backEv
_ZN9__gnu_cxx8__detail13__mini_vectorIPyE9push_backERKS2_
_ZN9__gnu_cxx8__detail13__mini_vectorIPyEC1Ev
_ZN9__gnu_cxx8__detail13__mini_vectorIPyEC2Ev
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE10deallocateEPS7_y
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE5clearEv
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE5eraseEPS7_
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE6insertEPS7_RKS7_
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE8allocateEy
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE8pop_backEv
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE9push_backERKS7_
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EEC1Ev
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EEC2Ev
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE10deallocateEPS7_y
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE5clearEv
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE5eraseEPS7_
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE6insertEPS7_RKS7_
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE8allocateEy
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE8pop_backEv
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE9push_backERKS7_
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EEC1Ev
_ZN9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EEC2Ev
_ZN9__gnu_cxx9__freeresEv
_ZN9__gnu_cxx9free_list6_M_getEy
_ZN9__gnu_cxx9free_list8_M_clearEv
_ZN9__gnu_cxxeqIPKcNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEEbRKNS_17__normal_iteratorIT_T0_EESE_
_ZN9__gnu_cxxeqIPKcSsEEbRKNS_17__normal_iteratorIT_T0_EES8_
_ZN9__gnu_cxxeqIPKwNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEEEbRKNS_17__normal_iteratorIT_T0_EESE_
_ZN9__gnu_cxxeqIPKwSbIwSt11char_traitsIwESaIwEEEEbRKNS_17__normal_iteratorIT_T0_EESC_
_ZN9__gnu_cxxeqIPcNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEEbRKNS_17__normal_iteratorIT_T0_EESD_
_ZN9__gnu_cxxeqIPcSsEEbRKNS_17__normal_iteratorIT_T0_EES7_
_ZN9__gnu_cxxeqIPwNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEEEbRKNS_17__normal_iteratorIT_T0_EESD_
_ZN9__gnu_cxxeqIPwSbIwSt11char_traitsIwESaIwEEEEbRKNS_17__normal_iteratorIT_T0_EESB_
_ZNK10__cxxabiv117__class_type_info10__do_catchEPKSt9type_infoPPvj
_ZNK10__cxxabiv117__class_type_info11__do_upcastEPKS0_PKvRNS0_15__upcast_resultE
_ZNK10__cxxabiv117__class_type_info11__do_upcastEPKS0_PPv
_ZNK10__cxxabiv117__class_type_info12__do_dyncastExNS0_10__sub_kindEPKS0_PKvS3_S5_RNS0_16__dyncast_resultE
_ZNK10__cxxabiv117__class_type_info20__do_find_public_srcExPKvPKS0_S2_
_ZNK10__cxxabiv117__pbase_type_info10__do_catchEPKSt9type_infoPPvj
_ZNK10__cxxabiv117__pbase_type_info15__pointer_catchEPKS0_PPvj
_ZNK10__cxxabiv119__pointer_type_info14__is_pointer_pEv
_ZNK10__cxxabiv119__pointer_type_info15__pointer_catchEPKNS_17__pbase_type_infoEPPvj
_ZNK10__cxxabiv120__function_type_info15__is_function_pEv
_ZNK10__cxxabiv120__si_class_type_info11__do_upcastEPKNS_17__class_type_infoEPKvRNS1_15__upcast_resultE
_ZNK10__cxxabiv120__si_class_type_info12__do_dyncastExNS_17__class_type_info10__sub_kindEPKS1_PKvS4_S6_RNS1_16__dyncast_resultE
_ZNK10__cxxabiv120__si_class_type_info20__do_find_public_srcExPKvPKNS_17__class_type_infoES2_
_ZNK10__cxxabiv121__vmi_class_type_info11__do_upcastEPKNS_17__class_type_infoEPKvRNS1_15__upcast_resultE
_ZNK10__cxxabiv121__vmi_class_type_info12__do_dyncastExNS_17__class_type_info10__sub_kindEPKS1_PKvS4_S6_RNS1_16__dyncast_resultE
_ZNK10__cxxabiv121__vmi_class_type_info20__do_find_public_srcExPKvPKNS_17__class_type_infoES2_
_ZNK10__cxxabiv129__pointer_to_member_type_info15__pointer_catchEPKNS_17__pbase_type_infoEPPvj
_ZNK11__gnu_debug16_Error_formatter10_M_messageENS_13_Debug_msg_idE
_ZNK11__gnu_debug16_Error_formatter10_Parameter14_M_print_fieldEPKS0_PKc
_ZNK11__gnu_debug16_Error_formatter10_Parameter20_M_print_descriptionEPKS0_
_ZNK11__gnu_debug16_Error_formatter13_M_print_wordEPKc
_ZNK11__gnu_debug16_Error_formatter14_M_format_wordIPKcEEvPciS3_T_
_ZNK11__gnu_debug16_Error_formatter14_M_format_wordIPKvEEvPciPKcT_
_ZNK11__gnu_debug16_Error_formatter14_M_format_wordIlEEvPciPKcT_
_ZNK11__gnu_debug16_Error_formatter14_M_format_wordIyEEvPciPKcT_
_ZNK11__gnu_debug16_Error_formatter15_M_print_stringEPKc
_ZNK11__gnu_debug16_Error_formatter17_M_get_max_lengthEv
_ZNK11__gnu_debug16_Error_formatter8_M_errorEv
_ZNK11__gnu_debug19_Safe_iterator_base11_M_singularEv
_ZNK11__gnu_debug19_Safe_iterator_base14_M_can_compareERKS0_
_ZNK11__gnu_debug25_Safe_local_iterator_base16_M_get_containerEv
_ZNK9__gnu_cxx12__pool_allocIcE7addressERKc
_ZNK9__gnu_cxx12__pool_allocIcE7addressERc
_ZNK9__gnu_cxx12__pool_allocIcE8max_sizeEv
_ZNK9__gnu_cxx12__pool_allocIwE7addressERKw
_ZNK9__gnu_cxx12__pool_allocIwE7addressERw
_ZNK9__gnu_cxx12__pool_allocIwE8max_sizeEv
_ZNK9__gnu_cxx16bitmap_allocatorIcE7addressERKc
_ZNK9__gnu_cxx16bitmap_allocatorIcE7addressERc
_ZNK9__gnu_cxx16bitmap_allocatorIcE8max_sizeEv
_ZNK9__gnu_cxx16bitmap_allocatorIwE7addressERKw
_ZNK9__gnu_cxx16bitmap_allocatorIwE7addressERw
_ZNK9__gnu_cxx16bitmap_allocatorIwE8max_sizeEv
_ZNK9__gnu_cxx24__concurrence_lock_error4whatEv
_ZNK9__gnu_cxx24__concurrence_wait_error4whatEv
_ZNK9__gnu_cxx26__concurrence_unlock_error4whatEv
_ZNK9__gnu_cxx29__concurrence_broadcast_error4whatEv
_ZNK9__gnu_cxx8__detail13__mini_vectorIPyE13_M_space_leftEv
_ZNK9__gnu_cxx8__detail13__mini_vectorIPyE3endEv
_ZNK9__gnu_cxx8__detail13__mini_vectorIPyE4backEv
_ZNK9__gnu_cxx8__detail13__mini_vectorIPyE4sizeEv
_ZNK9__gnu_cxx8__detail13__mini_vectorIPyE5beginEv
_ZNK9__gnu_cxx8__detail13__mini_vectorIPyEixEy
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE13_M_space_leftEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE3endEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE4backEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE4sizeEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EE5beginEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIcE12_Alloc_blockES6_EEixEy
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE13_M_space_leftEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE3endEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE4backEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE4sizeEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EE5beginEv
_ZNK9__gnu_cxx8__detail13__mini_vectorISt4pairIPNS_16bitmap_allocatorIwE12_Alloc_blockES6_EEixEy
_ZNKRSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE3strEv
_ZNKRSt7__cxx1115basic_stringbufIwSt11char_traitsIwESaIwEE3strEv
_ZNKRSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEE3strEv
_ZNKRSt7__cxx1118basic_stringstreamIwSt11char_traitsIwESaIwEE3strEv
_ZNKRSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEE3strEv
_ZNKRSt7__cxx1119basic_istringstreamIwSt11char_traitsIwESaIwEE3strEv
_ZNKRSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEE3strEv
_ZNKRSt7__cxx1119basic_ostringstreamIwSt11char_traitsIwESaIwEE3strEv
_ZNKSbIwSt11char_traitsIwESaIwEE11_M_disjunctEPKw
_ZNKSbIwSt11char_traitsIwESaIwEE12find_last_ofEPKwy
_ZNKSbIwSt11char_traitsIwESaIwEE12find_last_ofEPKwyy
_ZNKSbIwSt11char_traitsIwESaIwEE12find_last_ofERKS2_y
_ZNKSbIwSt11char_traitsIwESaIwEE12find_last_ofEwy
_ZNKSbIwSt11char_traitsIwESaIwEE13find_first_ofEPKwy
_ZNKSbIwSt11char_traitsIwESaIwEE13find_first_ofEPKwyy
_ZNKSbIwSt11char_traitsIwESaIwEE13find_first_ofERKS2_y
_ZNKSbIwSt11char_traitsIwESaIwEE13find_first_ofEwy
_ZNKSbIwSt11char_traitsIwESaIwEE13get_allocatorEv
_ZNKSbIwSt11char_traitsIwESaIwEE15_M_check_lengthEyyPKc
_ZNKSbIwSt11char_traitsIwESaIwEE16find_last_not_ofEPKwy
_ZNKSbIwSt11char_traitsIwESaIwEE16find_last_not_ofEPKwyy
_ZNKSbIwSt11char_traitsIwESaIwEE16find_last_not_ofERKS2_y
_ZNKSbIwSt11char_traitsIwESaIwEE16find_last_not_ofEwy
_ZNKSbIwSt11char_traitsIwESaIwEE17find_first_not_ofEPKwy
_ZNKSbIwSt11char_traitsIwESaIwEE17find_first_not_ofEPKwyy
_ZNKSbIwSt11char_traitsIwESaIwEE17find_first_not_ofERKS2_y
_ZNKSbIwSt11char_traitsIwESaIwEE17find_first_not_ofEwy
_ZNKSbIwSt11char_traitsIwESaIwEE2atEy
_ZNKSbIwSt11char_traitsIwESaIwEE3endEv
_ZNKSbIwSt11char_traitsIwESaIwEE4_Rep12_M_is_leakedEv
_ZNKSbIwSt11char_traitsIwESaIwEE4_Rep12_M_is_sharedEv
_ZNKSbIwSt11char_traitsIwESaIwEE4backEv
_ZNKSbIwSt11char_traitsIwESaIwEE4cendEv
_ZNKSbIwSt11char_traitsIwESaIwEE4copyEPwyy
_ZNKSbIwSt11char_traitsIwESaIwEE4dataEv
_ZNKSbIwSt11char_traitsIwESaIwEE4findEPKwy
_ZNKSbIwSt11char_traitsIwESaIwEE4findEPKwyy
_ZNKSbIwSt11char_traitsIwESaIwEE4findERKS2_y
_ZNKSbIwSt11char_traitsIwESaIwEE4findEwy
_ZNKSbIwSt11char_traitsIwESaIwEE4rendEv
_ZNKSbIwSt11char_traitsIwESaIwEE4sizeEv
_ZNKSbIwSt11char_traitsIwESaIwEE5beginEv
_ZNKSbIwSt11char_traitsIwESaIwEE5c_strEv
_ZNKSbIwSt11char_traitsIwESaIwEE5crendEv
_ZNKSbIwSt11char_traitsIwESaIwEE5emptyEv
_ZNKSbIwSt11char_traitsIwESaIwEE5frontEv
_ZNKSbIwSt11char_traitsIwESaIwEE5rfindEPKwy
_ZNKSbIwSt11char_traitsIwESaIwEE5rfindEPKwyy
_ZNKSbIwSt11char_traitsIwESaIwEE5rfindERKS2_y
_ZNKSbIwSt11char_traitsIwESaIwEE5rfindEwy
_ZNKSbIwSt11char_traitsIwESaIwEE6_M_repEv
_ZNKSbIwSt11char_traitsIwESaIwEE6cbeginEv

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/libwinpthread-1.dll
.dll windows:4 windows x64 arch:x64

b5d23cc55ec8f2edd6beee40a881b063

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2024, 20:38

Not After

14/06/2027, 20:05

Subject

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:1d:1d:e4:38:73:64:64:72:10:79:37:25:c3:55:48:5b:37:ca:2f:0a:c8:02:81:c2:4f:97:e8:85:70:5c:64
Signer

Actual PE Digest

6e:1d:1d:e4:38:73:64:64:72:10:79:37:25:c3:55:48:5b:37:ca:2f:0a:c8:02:81:c2:4f:97:e8:85:70:5c:64

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetProcessAffinityMask
GetProcessTimes
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject

msvcrt

__C_specific_handler
__iob_func
_amsg_exit
_beginthreadex
_endthreadex
_errno
_initterm
_lock
_setjmp
_ultoa
_unlock
abort
calloc
exit
fprintf
free
fwrite
malloc
memmove
memset
printf
realloc
signal
strlen
strncmp
vfprintf
longjmp
_strdup

Exports

Exports

__pth_gpointer_locked
__pthread_clock_nanosleep
_pthread_cleanup_dest
_pthread_get_state
_pthread_invoke_cancel
_pthread_key_dest
_pthread_rel_time_in_ms
_pthread_set_state
_pthread_time_in_ms
_pthread_time_in_ms_from_timespec
_pthread_tryjoin
clock_getres
clock_gettime
clock_nanosleep
clock_settime
nanosleep
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_timedwait_relative_np
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getclock
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setclock
pthread_condattr_setpshared
pthread_create
pthread_create_wrapper
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_get_concurrency
pthread_getclean
pthread_getconcurrency
pthread_getevent
pthread_gethandle
pthread_getname_np
pthread_getschedparam
pthread_getspecific
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getprioceiling
pthread_mutexattr_getprotocol
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setprioceiling
pthread_mutexattr_setprotocol
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_set_concurrency
pthread_set_num_processors_np
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setname_np
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_tls_init
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 400B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass/EasyAnti/sqlncli.h
README.txt
Resources/1033/sqlevn70.rll
.dll windows:6 windows x86 arch:x86

Code Sign

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2011, 22:39

Not After

01/02/2013, 22:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:95:30:7d:ce:9d:1a:9b:bb:d9:4b:23:7e:11:9d:3d:b4:fd:61:03:c9:1f:f1:93:d9:2d:07:49:f0:ce:39:ca
Signer

Actual PE Digest

ac:95:30:7d:ce:9d:1a:9b:bb:d9:4b:23:7e:11:9d:3d:b4:fd:61:03:c9:1f:f1:93:d9:2d:07:49:f0:ce:39:ca

Digest Algorithm

sha256

PE Digest Matches

true

09:04:c5:ba:d8:d8:61:20:7e:8c:96:65:57:98:28:ad:40:1d:4a:f6
Signer

Actual PE Digest

09:04:c5:ba:d8:d8:61:20:7e:8c:96:65:57:98:28:ad:40:1d:4a:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Resources/1049/sqlevn70.rll
.dll windows:6 windows x86 arch:x86

Code Sign

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2011, 22:39

Not After

01/02/2013, 22:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:92:ad:50:36:26:4b:9a:09:95:f0:2b:2c:fc:cc:17:c8:ae:e3:0a:a1:85:9e:7b:e8:2f:ec:b7:d0:1c:03:06
Signer

Actual PE Digest

9c:92:ad:50:36:26:4b:9a:09:95:f0:2b:2c:fc:cc:17:c8:ae:e3:0a:a1:85:9e:7b:e8:2f:ec:b7:d0:1c:03:06

Digest Algorithm

sha256

PE Digest Matches

true

f1:d4:ca:84:8f:57:ab:06:5e:99:5b:39:ff:80:a4:4f:a0:1a:7b:33
Signer

Actual PE Digest

f1:d4:ca:84:8f:57:ab:06:5e:99:5b:39:ff:80:a4:4f:a0:1a:7b:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Resources/AppSetings.dll
.dll windows:6 windows x64 arch:x64

4cda942bdf0e9b57573779d15bea1fa6

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d4:a7:4f:a4:06:6c:a2:c7:e6:84:08:ee:db:5b:cb:a3:78:2d:63:4f:af:d2:81:4a:22:65:14:9a:68:e0:67:c9
Signer

Actual PE Digest

d4:a7:4f:a4:06:6c:a2:c7:e6:84:08:ee:db:5b:cb:a3:78:2d:63:4f:af:d2:81:4a:22:65:14:9a:68:e0:67:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_hotfix_win64\build\src\crashhandler\win64\Release\crashhandler64.pdb

Imports

kernel32

OutputDebugStringW
CloseHandle
GetLastError
CreateEventA
Sleep
GetCurrentProcessId
CreateProcessW
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
DecodePointer
LCMapStringEx
InitializeCriticalSectionEx
GetSystemTime
RtlCaptureContext
VirtualQueryEx
GetCurrentProcess
SetUnhandledExceptionFilter
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
LoadLibraryW
IsDebuggerPresent
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
GetModuleFileNameA
LoadLibraryA
LocalAlloc
LocalFree
WideCharToMultiByte
RtlCaptureStackBackTrace
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
GlobalAlloc
GlobalUnlock
GlobalLock
LoadLibraryExA
MultiByteToWideChar
RaiseException
SetLastError
TryEnterCriticalSection
SetEvent
ResetEvent
WaitForMultipleObjects
GetExitCodeThread
DebugBreak
GetProcessHeaps
SetEnvironmentVariableW
WriteFile
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileSizeEx
ReadFile
SetEndOfFile
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
EncodePointer
ExitProcess
GetModuleHandleExW
HeapSize
HeapValidate
GetFileType
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
SetStdHandle
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
WriteConsoleW
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
OutputDebugStringA
CreateFileW
RtlUnwind

psapi

GetModuleBaseNameW
EnumProcessModules
GetProcessMemoryInfo

user32

EnumWindows
GetWindowThreadProcessId
GetDesktopWindow
EmptyClipboard
GetDlgItem
EndDialog
MessageBoxA
GetWindowRect
SetDlgItemTextA
GetWindowTextLengthA
SetClipboardData
GetDlgItemInt
CloseClipboard
SetDlgItemInt
OpenClipboard
wsprintfA
SetWindowPos
IsWindowVisible
DialogBoxParamA

shell32

CommandLineToArgvW

wininet

HttpQueryInfoW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetQueryDataAvailable
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetCrackUrlW
InternetOpenW

Exports

Exports

Breakpad_SetSteamID
CreateInterface
g_dwDllEntryThreadId

Sections

.text
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Resources/AppSettings.xml
.xml
Resources/Bypass.dll
.dll windows:4 windows x86 arch:x86

dc33390e11f40d35aacb3b7595b60d08

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/09/2015, 00:00

Not After

03/10/2018, 12:00

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:b1:01:21:ff:0d:6b:21:e2:db:68:ef:fb:a5:ce:d5:6d:be:ae:a5
Signer

Actual PE Digest

7b:b1:01:21:ff:0d:6b:21:e2:db:68:ef:fb:a5:ce:d5:6d:be:ae:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

u:\p4clients\taylor_pubkeys\ThirdPartyCode\DebugNet\Release\BugslayerUtil.pdb

Imports

dbghelp

SymSetOptions
SymGetSymFromAddr
SymGetOptions
SymLoadModule64
SymGetModuleInfo64
SymGetLineFromAddr64
SymGetSymFromAddr64
SymGetModuleBase64
SymLoadModule
SymCleanup
SymInitialize
StackWalk64
UnDecorateSymbolName
SymFunctionTableAccess64

kernel32

GetThreadContext
OutputDebugStringW
WriteFile
IsDebuggerPresent
GetProfileIntW
SearchPathW
LoadLibraryW
GetProcAddress
MultiByteToWideChar
GetModuleFileNameA
CreateFileA
WideCharToMultiByte
GetACP
RaiseException
GetModuleHandleW
SetUnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
FormatMessageW
lstrlenA
lstrcpynW
ReadProcessMemory
GlobalAlloc
GetCurrentProcess
GetCurrentThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LocalFree
ExitProcess
OutputDebugStringA
VirtualQueryEx
GetVersionExW
DisableThreadLibraryCalls
VirtualQuery
VirtualProtect
IsBadStringPtrA
IsBadStringPtrW
CreateFileW
CloseHandle
GetCurrentThreadId
OpenProcess
GetThreadPriority
SetThreadPriority
OpenThread
SuspendThread
ResumeThread
FreeLibrary
GlobalLock
GlobalUnlock
GetLocaleInfoW
FindResourceExW
LoadResource
LockResource
GetProcessHeap
HeapFree
lstrlenW
GetLastError
HeapAlloc
GetCurrentProcessId
SetLastError
InterlockedExchange
LocalAlloc
IsBadWritePtr
GlobalFree
HeapReAlloc
TlsSetValue
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
TerminateProcess
HeapSize
TlsFree
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemInfo
LCMapStringA
LCMapStringW
InitializeCriticalSection
SetFilePointer
GetOEMCP
GetCPInfo
LoadLibraryA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
RtlUnwind
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
FlushFileBuffers

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyW
RegCloseKey

Exports

Exports

AddClientDV
AddCrashHandlerLimitModule
AddDiagAssertModule
AllocAndFillProcessModuleList
BSUAnsi2Wide
BSUGetModuleBaseNameA
BSUGetModuleBaseNameW
BSUGetModuleFileNameExA
BSUGetModuleFileNameExW
BSUIsInteractiveUser
BSUSetCurrentThreadNameA
BSUSetCurrentThreadNameW
BSUSetThreadNameA
BSUSetThreadNameW
BSUSymInitializeA
BSUSymInitializeW
BSUWide2Ansi
CreateCurrentProcessCrashDumpA
CreateCurrentProcessCrashDumpW
DiagAssertA
DiagAssertW
DiagOutputA
DiagOutputW
GetFaultReason
GetFirstStackTraceString
GetLimitModuleCount
GetLimitModulesArray
GetLoadedModules
GetNextStackTraceString
GetProcessThreadIds
GetRegisterString
GetSuperAssertionCount
HookImportedFunctionsByNameA
HookImportedFunctionsByNameW
HookOrdinalExportA
HookOrdinalExportW
IsMiniDumpFunctionAvailable
IsNT
IsNT4
IsServer2003
IsServer2003orBetter
IsW2K
IsW2KorBetter
IsXP
IsXPorBetter
MemStressInitializeA
MemStressInitializeW
MemStressTerminate
SetCrashHandlerFilter
SetDiagAssertFile
SetDiagAssertOptions
SetDiagOutputFile
SnapCurrentProcessMiniDumpA
SnapCurrentProcessMiniDumpW
SuperAssertionA
SuperAssertionW
ValidateAllBlocks

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Resources/COPYRIGHT.txt
Startupe.exe
.exe windows:6 windows x64 arch:x64

0702c0ba8eb02f14cc11aa3a5d5a197e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryW
GetComputerNameA
VerifyVersionInfoW
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
VirtualProtect
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
CreateProcessA
Sleep
GetEnvironmentVariableW
GetProcessHeap
VerSetConditionMask
FindFirstFileExW
FindClose
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
RtlUnwind

user32

GetMessageW
LoadIconW
MessageBoxW
GetClientRect
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage

gdi32

SetBkColor
CreateSolidBrush
CreateFontW
SetTextColor

shell32

SHGetFolderPathW
SHGetFolderPathA
ShellExecuteW

urlmon

URLDownloadToFileW

Sections

.text
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71.3MB - Virtual size: 71.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fdCertificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

d1:57:b9:73:75:5b:9d:df:ae:de:17:ea:71:0b:59:2f:78:71:f2:58:1b:12:b8:8d:40:f3:36:97:65:0e:e8:9dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 67KB - Virtual size: 66KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fdCertificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

98:1e:99:0a:36:af:0c:51:ed:31:cb:9a:08:6d:1c:c5:da:58:5c:c7:29:42:b1:6a:5d:60:ba:8a:09:bd:74:9dSigner

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

d1:57:b9:73:75:5b:9d:df:ae:de:17:ea:71:0b:59:2f:78:71:f2:58:1b:12:b8:8d:40:f3:36:97:65:0e:e8:9d
Signer

.text
Size: 67KB - Virtual size: 66KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

98:1e:99:0a:36:af:0c:51:ed:31:cb:9a:08:6d:1c:c5:da:58:5c:c7:29:42:b1:6a:5d:60:ba:8a:09:bd:74:9d
Signer

.text
Size: 160KB - Virtual size: 160KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

09:75:70:18:1f:13:9c:53:02:75:76:6a:cc:87:ca:20:90:b1:40:4c:8c:15:25:e4:52:1e:2a:f9:61:0d:21:ff
Signer

.text
Size: 438KB - Virtual size: 437KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

44:fa:11:07:73:38:ec:4c:dc:6f:fb:7e:2f:5b:cb:7d:d7:0f:a5:36:64:c8:3c:f4:12:92:70:84:87:c0:a5:0b
Signer

.text
Size: 54KB - Virtual size: 54KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate