blackguard | a759f450c9f1e6815b3dccd0ffd77e183794334eaf60ba77fb0cd7e5a7d7fdda

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

resource
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avgntflt.sys
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avipbb.sys
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avkmgr.sys
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avgntflt.sys
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avipbb.sys
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avkmgr.sys
unpack001/$APPDATA/TotalAV/updates/SAVAPI 8.0.1/plg_fops_dummy.dll
unpack001/$PLUGINSDIR/AccessControl.dll
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/SysRestore.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/Accessibility.dll
unpack001/BouncyCastle.Crypto.dll
unpack001/DotNetZip.dll
unpack001/EntityFramework.SqlServer.dll
unpack001/EntityFramework.dll
unpack001/HtmlAgilityPack.dll
unpack001/Microsoft.AppCenter.Analytics.dll
unpack001/Microsoft.AppCenter.Crashes.dll
unpack001/Microsoft.AppCenter.dll
unpack001/Microsoft.CSharp.dll
unpack001/Microsoft.Extensions.Configuration.Abstractions.dll
unpack001/Microsoft.Extensions.Configuration.Binder.dll
unpack001/Microsoft.Extensions.Configuration.dll
unpack001/Microsoft.Extensions.DependencyInjection.Abstractions.dll
unpack001/Microsoft.Extensions.DependencyInjection.dll
unpack001/Microsoft.Extensions.Logging.Abstractions.dll
unpack001/Microsoft.Extensions.Logging.dll
unpack001/Microsoft.Extensions.Options.dll
unpack001/Microsoft.Extensions.Primitives.dll
unpack001/Microsoft.Win32.Primitives.dll
unpack001/Microsoft.Win32.Registry.AccessControl.dll
unpack001/Microsoft.Win32.Registry.dll
unpack001/Microsoft.Win32.SystemEvents.dll
unpack001/Mindscape.Raygun4Net.NetCore.Common.dll
unpack001/Mindscape.Raygun4Net.NetCore.dll
unpack001/NamedPipeServerStream.NetFrameworkVersion.dll
unpack001/Netlib.dll
unpack001/Newtonsoft.Json.dll
unpack001/Nito.AsyncEx.Context.dll
unpack001/Nito.AsyncEx.Coordination.dll
unpack001/Nito.AsyncEx.Interop.WaitHandles.dll
unpack001/Nito.AsyncEx.Oop.dll
unpack001/Nito.AsyncEx.Tasks.dll
unpack001/Nito.Cancellation.dll
unpack001/Nito.Collections.Deque.dll
unpack001/Nito.Disposables.dll
unpack001/PresentationCore.dll
unpack001/PresentationFramework-SystemCore.dll
unpack001/PresentationFramework-SystemData.dll
unpack001/PresentationFramework-SystemDrawing.dll
unpack001/PresentationFramework-SystemXml.dll
unpack001/PresentationFramework-SystemXmlLinq.dll
unpack001/PresentationFramework.Aero.dll
unpack001/PresentationFramework.Aero2.dll
unpack001/PresentationFramework.AeroLite.dll
unpack001/PresentationFramework.Classic.dll
unpack001/PresentationFramework.Luna.dll
unpack001/PresentationFramework.Royale.dll
unpack001/PresentationFramework.dll
unpack001/PresentationUI.dll
unpack001/PropertyChanged.dll
unpack001/ReachFramework.dll
unpack001/SAVAPI/on_access/win32/win8/avgntflt.sys
unpack001/SAVAPI/on_access/win32/win8/avipbb.sys
unpack001/SAVAPI/on_access/win32/win8/avkmgr.sys
unpack001/SAVAPI/on_access/win64/win8/avgntflt.sys
unpack001/SAVAPI/on_access/win64/win8/avipbb.sys
unpack001/SAVAPI/on_access/win64/win8/avkmgr.sys
unpack001/SAVAPI/plg_fops_dummy.dll
unpack001/SQLite.Interop.dll
unpack001/SQLitePCLRaw.batteries_v2.dll
unpack001/SQLitePCLRaw.core.dll
unpack001/SQLitePCLRaw.nativelibrary.dll
unpack001/SQLitePCLRaw.provider.dynamic_cdecl.dll
unpack001/System.CodeDom.dll
unpack001/System.Collections.Immutable.dll
unpack001/System.Collections.NonGeneric.dll
unpack001/System.Collections.Specialized.dll
unpack001/System.ComponentModel.Annotations.dll
unpack001/System.ComponentModel.Composition.Registration.dll
unpack001/System.ComponentModel.Composition.dll
unpack001/System.ComponentModel.EventBasedAsync.dll
unpack001/System.ComponentModel.Primitives.dll
unpack001/System.ComponentModel.TypeConverter.dll
unpack001/System.ComponentModel.dll
unpack001/System.Configuration.ConfigurationManager.dll
unpack001/System.Configuration.Install.dll
unpack001/System.Console.dll
unpack001/System.Data.Common.dll
unpack001/System.Data.Odbc.dll
unpack001/System.Data.OleDb.dll
unpack001/System.Data.SQLite.EF6.dll
unpack001/System.Data.SQLite.dll
unpack001/System.Data.SqlClient.dll
unpack001/System.Design.dll
unpack001/System.Diagnostics.DiagnosticSource.dll
unpack001/System.Diagnostics.EventLog.dll
unpack001/System.Diagnostics.FileVersionInfo.dll
unpack001/System.Diagnostics.PerformanceCounter.dll
unpack001/System.Diagnostics.Process.dll
unpack001/System.DirectoryServices.AccountManagement.dll
unpack001/System.DirectoryServices.Protocols.dll
unpack001/System.DirectoryServices.dll
unpack001/System.Drawing.Common.dll
unpack001/System.Drawing.Design.dll
unpack001/System.Drawing.Primitives.dll
unpack001/System.Drawing.dll
unpack001/System.IO.Compression.Brotli.dll
unpack001/System.IO.Compression.dll
unpack001/System.IO.FileSystem.AccessControl.dll
unpack001/System.IO.FileSystem.DriveInfo.dll
unpack001/System.IO.FileSystem.Watcher.dll
unpack001/System.IO.FileSystem.dll
unpack001/System.IO.IsolatedStorage.dll
unpack001/System.IO.MemoryMappedFiles.dll
unpack001/System.IO.Packaging.dll
unpack001/System.IO.Pipes.dll
unpack001/System.IO.Ports.dll
unpack001/System.Linq.Expressions.dll
unpack001/System.Linq.Parallel.dll
unpack001/System.Linq.Queryable.dll
unpack001/System.Linq.dll
unpack001/System.Management.dll
unpack001/System.Net.Http.dll
unpack001/System.Net.NameResolution.dll
unpack001/System.Net.NetworkInformation.dll
unpack001/System.Net.Primitives.dll
unpack001/System.Net.Requests.dll
unpack001/System.Net.Security.dll
unpack001/System.Net.ServicePoint.dll
unpack001/System.Net.Sockets.dll
unpack001/System.Net.WebClient.dll
unpack001/System.Net.WebHeaderCollection.dll
unpack001/System.Net.WebProxy.dll
unpack001/System.Net.WebSockets.Client.dll
unpack001/System.Net.WebSockets.dll
unpack001/System.ObjectModel.dll
unpack001/System.Private.DataContractSerialization.dll
unpack001/System.Private.ServiceModel.dll
unpack001/System.Private.Xml.Linq.dll
unpack001/System.Private.Xml.dll
unpack001/System.Reflection.Context.dll
unpack001/System.Reflection.DispatchProxy.dll
unpack001/System.Reflection.Metadata.dll
unpack001/System.Resources.Extensions.dll
unpack001/System.Resources.Writer.dll
unpack001/System.Runtime.Caching.dll
unpack001/System.Runtime.CompilerServices.Unsafe.dll
unpack001/System.Runtime.CompilerServices.VisualC.dll
unpack001/System.Runtime.InteropServices.RuntimeInformation.dll
unpack001/System.Runtime.Numerics.dll
unpack001/System.Runtime.Serialization.Primitives.dll
unpack001/System.Security.AccessControl.dll
unpack001/System.Security.Claims.dll
unpack001/System.Security.Cryptography.Algorithms.dll
unpack001/System.Security.Cryptography.Cng.dll
unpack001/System.Security.Cryptography.Csp.dll
unpack001/System.Security.Cryptography.Encoding.dll
unpack001/System.Security.Cryptography.Pkcs.dll
unpack001/System.Security.Cryptography.Primitives.dll
unpack001/System.Security.Cryptography.ProtectedData.dll
unpack001/System.Security.Cryptography.X509Certificates.dll
unpack001/System.Security.Cryptography.Xml.dll
unpack001/System.Security.Permissions.dll
unpack001/System.Security.Principal.Windows.dll
unpack001/System.ServiceModel.Duplex.dll
unpack001/System.ServiceModel.Http.dll
unpack001/System.ServiceModel.NetTcp.dll
unpack001/System.ServiceModel.Primitives.dll
unpack001/System.ServiceModel.Security.dll
unpack001/System.ServiceModel.Syndication.dll
unpack001/System.ServiceModel.dll
unpack001/System.ServiceProcess.ServiceController.dll
unpack001/System.Text.Encoding.CodePages.dll
unpack001/System.Text.RegularExpressions.dll
unpack001/System.Threading.AccessControl.dll
unpack001/System.Transactions.Local.dll
unpack001/System.Web.HttpUtility.dll
unpack001/System.Windows.Controls.Ribbon.dll
unpack001/System.Windows.Extensions.dll
unpack001/System.Windows.Forms.Design.Editors.dll
unpack001/System.Windows.Forms.Design.dll
unpack001/System.Windows.Forms.dll
unpack001/System.Windows.Input.Manipulations.dll
unpack001/System.Windows.Presentation.dll
unpack001/System.Xaml.dll
unpack001/System.Xml.XPath.XmlDocument.dll
unpack001/Trinet.Core.IO.Ntfs.dll
unpack001/UIAutomationClient.dll
unpack001/UIAutomationClientSideProviders.dll
unpack001/UIAutomationProvider.dll
unpack001/UIAutomationTypes.dll
unpack001/UiPath.CoreIpc.dll
unpack001/Utilizr.NotifyIcon.dll
unpack001/Utilizr.OpenVPN.dll
unpack001/Utilizr.VPN.RasSharp.NetCore.dll
unpack001/Utilizr.VPN.dll
unpack001/Utilizr.dll
unpack001/Utilzr.WPF.dll
unpack001/Webshield.Client.dll
unpack001/WindowsBase.dll
unpack001/WindowsFormsIntegration.dll
unpack001/cachey-bashi.netcore.dll
unpack001/e_sqlite3.dll
unpack001/libcrypto-1_1.dll
unpack001/libssl-1_1.dll
unpack001/mscorlib.dll
unpack001/netstandard.dll
unpack001/nfregdrv.exe
unpack001/pwm.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

a759f450c9f1e6815b3dccd0ffd77e183794334eaf60ba77fb0cd7e5a7d7fdda

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 a759f450c9f1e6815b3dccd0ffd77e183794334eaf60ba77fb0cd7e5a7d7fdda
MD5 5c61b919d5e5bef168828f597bba08f7
SHA1 08dcc90278ebb0062b7ba54755c150aa4d74c52f
SHA512 ccda69ac564e8dafb600dcabbc1e77e18513372eaba96b0d892cd0c20557516f934157b8837580c88d7eeda28db9db0fedc026a19b7a0355b80e3c80081df230
SSDEEP 1572864:05ORAgTwb7Sido1ytYZ4t4wgCVgzrZ5M6bVTacJX:BRAHSidIjwg7vhEcX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ce:4a:92:b0:86:a2:f4:bb:5f:ce:79:ca:77:b9:70:39:70:b0:45:f4:d3:f0:10:e9:32:a2:69:6a:af:c3:55:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aebb.dll

IMPHASH d811d71710ad58776155b7a8da1fa9db
SHA256 cbcf727bb8b75864509ca1c7d68d4ef51d64a18b15b3e1145f94cd50f29746cc
MD5 f81983581bdb64f2b9234ad881b9c7c1
SHA1 a12e1674498d3859f5e867d1c958b3a72047bf62
SHA512 03fa42f9fc249be0c2269a076ec95b50e7d323587f5b1b4325549dd010eb2500b0ef8713d1e40c99a6de89abf30a3fc8a01b2d9f77bf224b5a51b2826bb53754
SSDEEP 768:9YYeKlKHPrmWYGQvredEzQiWidVtj44H6Kd3SVI2HAK2P3hh+:3PGQvrd5LtxHZcHgKW3hh+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ca:3d:4f:97:15:d3:16:30:a1:31:7b:e7:c6:6a:84:03:fa:5a:2c:c2:c6:09:32:5b:77:e4:4b:54:80:11:90:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 18, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

d3:aa:4b:46:f5:18:eb:ab:ab:eb:5e:e4:68:4a:11:cc:c9:c0:a3:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 18, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

7456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aecore.dll

IMPHASH 5d921e44c14b3b12b2fe53a7f6d0d3b0
SHA256 cef4cf51942dc337a371d3487ee87e9e2e9b2c82a34fa9b81d7beecd9e56810e
MD5 3aade81602e5fd66d24b28a8f4d0edf4
SHA1 023193e6b32112153ed8addbbf8c2feb7684d379
SHA512 08cf9bd46da4a231675bbe7716e71dc25326d8b4238cab9be28c04895e86d27ae2430be0b94a7fbe1c61a35c9d39d2c95eea283b254eb776b8ccf655638f3a7e
SSDEEP 3072:hs7523SuHq0Qx10YXQySzjqQPel7k3hGd5WKSGAL9M+OgMTZFXGH2tLg+Vc:hLbHqhx7QhqQPKky5WKSdLOaUz7u
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

3f:1b:c8:8a:81:bb:ef:76:0e:09:32:ca:ae:bb:fe:3b:e1:7c:24:24:8a:d2:34:ea:18:42:e0:95:08:9d:04:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 13, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

45:22:f5:ce:33:82:0f:6b:16:8e:71:73:f4:2d:d4:1f:54:6d:a0:90

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jul 13, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

4

Entry point

183374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetFilePointer WriteFile CreateFileW CloseHandle GetFileSize ReadFile LoadLibraryW GetProcAddress FreeLibrary HeapAlloc HeapFree FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW SetFileAttributesW GetFileAttributesW DeleteFileW MoveFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate ExitProcess GetStdHandle GetModuleFileNameA GetFullPathNameW GetCurrentDirectoryA Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSection RtlUnwind LoadLibraryA GetTimeZoneInformation SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetDriveTypeA FlushFileBuffers CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aecrypto.dll

IMPHASH 22b98c5c8c68a5c45b232e3b1c1c06e3
SHA256 5ef4587c5e57c4b54c321e715907c56d73ace1ef727abf3f6ae52aed644485ef
MD5 77c7aed77a8358f1852328ba89c68e64
SHA1 597abdfa4738ee304f4bb049e822850918a5ddf1
SHA512 7156b8d0588bf43986582e853bcf29abc2d6cd03a957270e2c3d555744c1c82ac22420a0b036716cb954fd1d84fc86d35d8dc951d876d7fd2b0349ed8237a226
SSDEEP 3072:0dQdHHx1InHeIHapjcRa09MHapjcR7Rflj3owtq9dhT+LA:NdHH/IHlHap4RMHap4RbWKLA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9b:eb:b2:52:73:ee:fc:83:90:41:c7:25:07:5e:99:a2:b5:ad:1d:cf:35:43:a9:c4:1a:a2:9a:f5:14:c9:e6:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 7, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b9:5c:57:5c:d3:0e:f8:15:80:e1:64:be:87:9a:9c:57:46:c2:09:bf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 7, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

53567

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aedroid.dll

IMPHASH 7bc8099b6a6590ff892d32831998203f
SHA256 008d570142dec8cd337fe28216a122fad8e52f8eafa564729e146f1572d7a97f
MD5 465282f73c5bf55c9f91e01e8cca14f0
SHA1 b141c74c85e8b87591dfa883680e9588e00c5a61
SHA512 89ba2743948b5ee9cc0f375b89167d64abf5bad838777b3c179c9606df5252cca0da2830cf6c75d6a4437397dfc80c09551f6b3925a8045489652c02e6ed1645
SSDEEP 49152:jyoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/QzP+gv:jyoyI4rlfff/MtGcMnrjD4LTQXJfRI1h
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

67:89:39:32:96:38:ac:52:08:d6:2a:85:a3:a1:2c:95:78:66:6e:57:ee:98:01:ec:01:13:dd:d6:64:62:70:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 31, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

79:aa:20:23:87:6d:d1:80:77:5d:00:a0:80:00:e2:07:b1:81:27:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Mar 31, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Serial Number

33:90:20:77:61:c4:26:dd:94:50:03:0d

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

106768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aedroid_gwf.dat

SHA256 50a9af9ac743d6a7f2741a3ab39717c8c7e618630b7688dab60b57b97f840b9d
MD5 961a1c1e0dfb8b54019c9ccec510b3ad
SHA1 ced9c7e98809bb7506a17644144efcbf50bfd10a
SHA512 fca12aea31d0cb3b71b73456606b91d97f6bd3366591b65191ce6edda8b6ca8d53e07da4a5a95d9242a43b2c20842dfc1f9b39bb4ddc47058afd86530bb2afe4
SSDEEP 98304:pn7ccmeV0TkXxuwIxSt/C5ytS0BLC5KjeVdL+l/wSFHiw/OGPWqxcH8U:VccJ0TkhuLx2qyt/LC5vXGYSl9nOBHh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeemu.dll

IMPHASH a885bb13f0531bf0fe4a26dbed53e311
SHA256 daf4f56cffc30b604d238df30e96332dba84447399597cc7bfb94ab02cddec63
MD5 a77547ea30c7e99dbf395e2135d5ee55
SHA1 2383bfff89a586aae2a4e99072b5b740d7115240
SHA512 ab99353214ee63b3d89dab90722fd4026f76959e7e96085ac93a457f53df9378bfbd35ec33bf7aaee0870d0a7b8ecff4601b5b360465a60d10591204cf953eef
SSDEEP 12288:ATDo2ZqPL80e/tkut8TNPpCXKQN7f4w8TMf5DTCi5xSfkpW+KV79mgAs3n5GPo:A/o2ZqPL80e/tkut8TNPpCXKQN7f4w8f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7b:ef:cc:d3:0e:dd:ba:20:63:1f:0f:ec:f4:52:15:c3:57:6f:a1:b6:22:62:98:75:31:dd:3f:40:68:75:6d:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 18, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

f1:75:c8:ad:54:e7:e7:d0:8b:fb:e1:d5:aa:6b:00:71:06:21:82:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 18, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

314720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp.dll

IMPHASH 7187e63926d02e5a031851538d8c773a
SHA256 5114b2b29aa5ee2e3bd8eb2c52a9f75e2749a7933f59ecdcb3898d694f015fac
MD5 8ace5e4e409b42940145bf1859463791
SHA1 7a0ff7aad25a802f36a70f4936b699042421f52f
SHA512 7049df679deb104110d9188de2a46ffee0ebaca5b3526c7cc66546995c5494caaed3b2152a8943de7c2a9fb5efa8f4309a7bd94390956a206b82969a221592d8
SSDEEP 6144:Yz1XwJegZMXkALf8EnDx8L+rN0QmwAdWy9kvTZceYD+Pzb8ljBg0kS:CIZ6DWL+rNmjYy9BeYbPz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

dd:30:17:7d:6f:d8:07:f4:6c:00:af:ed:c4:09:57:64:ac:0c:f7:66:c6:50:d6:ec:11:85:fa:8d:2d:57:68:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 5, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

c1:52:75:df:d8:ee:d2:f3:1e:b9:dd:57:4c:1f:40:86:b7:64:21:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Mar 5, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

133470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp_gwf.dat

SHA256 2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
MD5 d68dbed2d9e81bb670e94b0b550cccdf
SHA1 edebaf42b7b772274ffbdf070d965aa585cb14f4
SHA512 162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
SSDEEP 1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aegen.dll

IMPHASH 06ae0e1fd5b99dde689ae499a2670f2f
SHA256 c4d2e5f648644e85412cc619691d949c2933a74b64c190ec7df0ea5c9e7138f8
MD5 a572a2f67a845e1a6bea336ea5dad9a3
SHA1 7fc49d3d3da6f4ec047397c8a3f0097453859999
SHA512 f940adf670c3c51f17aa62bdeaf6bc5f8cd3e0b9b24b1167f6a8a63cb03573935c974688bee440b3636b7672806e63034309c13d97e5e17fceddc15fbbd00cc3
SSDEEP 12288:9JzLbloGZFABTYFuym1Fp5NqAZVmW0/dvswwtZeQ82wR1fYl59yDV:fzLbloGHABYEym1Fp5Nq6GdUwwtZeQ8H
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

24:40:3a:e0:46:ae:65:ef:d6:f4:41:e1:c4:92:04:a3:2c:b4:fd:9f:82:b5:6c:cf:c4:b0:e5:63:b4:ed:ea:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 21, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

1e:71:1b:66:33:26:de:57:ad:4a:f7:6b:89:40:85:60:3e:0e:88:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jun 21, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

582764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aehelp.dll

IMPHASH cc6d764effee6149756ba277acbb1c25
SHA256 f4cca57e7310c76ee4741132e5391089f4182caa0c13dad46c2e04022fd83cad
MD5 4fd11be4967e66290090f0acbb402e09
SHA1 bdfe8f35e5dc8044e64850496c7f45d30327519c
SHA512 f9726ebace35fc1371c9eb0967bd1e834c413adbdce50815ab7d28deaf65c9170f879920ad703dcc524fde34cef8dad30818548ac4b7b04d54d11c3b9c07ce7b
SSDEEP 6144:Zg6abREzUxcSgulWoteQYMLIWlaDhDLVH:O69zPFglksadDBH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

40:50:c1:fa:e4:d0:ed:80:80:9b:fb:13:53:8f:1e:22:34:ef:9b:82:36:49:b9:97:29:4d:40:e1:c4:b4:38:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 10, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

79:ca:92:f6:09:05:81:3c:42:c0:32:0d:6d:11:c2:86:b4:be:1b:6d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Feb 10, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

161418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur.dll

IMPHASH c22c9e0542d8112c6f552d671ead8ab2
SHA256 fe0b17e2e99676be58fbdd69b3a15eb172d81cbf701e894ad1ac42773cf24b75
MD5 fb16fceb4abdbf6d8f1be151924fcd73
SHA1 a56c60a6efe421aea7b4710c200a79f1c353a74f
SHA512 08f88e9c49853a9fb42fdd7a7567c5a74c8819115fa5639facb89a5a9d7d2a215187f8a32436ca5a94f14372921944ac391998b7acf50fb33a18073c6b5bd018
SSDEEP 196608:3BhXYuuLuywlMGdXSCOeVNluvHsxicIiSRvHqPCvlgIScOW6wjNc:kfJV/OWM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

17:a9:29:c5:39:28:a1:32:53:3f:92:4e:24:43:a1:b1:58:16:3b:31:fd:e5:78:69:73:ba:e8:d8:4f:c6:f8:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 21, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

5b:85:3b:c3:10:70:6f:29:15:2e:bf:8f:6e:3d:c6:2d:79:a2:82:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 21, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

9610388

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_agen.dat

SHA256 5032089b644646e4e17890af77f0735e78c9b0cc98fb05506239518be42807c7
MD5 068ac37ab32582b1ddc2b67c37d26579
SHA1 1d9242363774eabec85c40e9068ece04ac47b2ff
SHA512 550fd39bf1d590eeaad6a1527e4c6b72d9b266ce6b87538b834334cfebf8801be3365d941a4d61060824e13a373925b412d9502109748c08eb814c66b231c4aa
SSDEEP 24576:rrN1azun/taYrxuk3XHTx1Tx3VS2sJphZSWe1ppkaahDAAXPKCpD84IxY:PN1b/t5rE49Bx8pJFSWg2BSCYxY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_gwf.dat

SHA256 b90baa70bd07bc5b3573909b37a6cf4fcccc3d7c9702806c94bd843988d0ed5d
MD5 27dbb4a716dc8d87eac34a14f814dbc8
SHA1 2f3c673d444a0b996d609136d8741f6dfc47ba6a
SHA512 dcfba0317f02771d40fa190e78c19fa2e178d0ffadd6b8d22da4be7f66a3e7983da2a0c14741ab9df0d9f034754c4ea758d758ec7a65c53f77f922d13648e9a5
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_mv.dat

SHA256 8623727934f3cf7bf160214e47e6f3691673d82c3035a316a8f3f6e2738ab116
MD5 444837d881e5ee243e0d378318ea50b4
SHA1 ec1fa6999a8b297103199032527ac82de1f71730
SHA512 a27e2e1a5032a1198c06bfd64bb09c4ec1423ff99a43d7b05512ddd52d8da8023dd2e6ad18b1d1a881a59a49e1bf16419e42b97c119fc4164fb87dad6d9604f5
SSDEEP 24576:CXQ7NQ74StSlFGD2npLqhqi0JRh78fVNmNxrcJpMAMNbo1XeA508eY5pp2jAVkW1:FN9M2AhknQ6Bge7A51b
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelibinf.dll

IMPHASH 22b98c5c8c68a5c45b232e3b1c1c06e3
SHA256 00da20e602fa16db217f0e947e810230bd9ddf859b902d32d9c1fde813be9f33
MD5 b871e50964730df56ba2782bcff46d97
SHA1 c50a71ed3cbd0c3a362b34d80e69260cfa67f1f8
SHA512 478f05df9dde5950b211ab3ceb14391352114d75de3abf80070ffe569bcd7b32f930f28321b9667b72933955db2f366f03892cef130780990ef85f438019ec2a
SSDEEP 768:VVH0SGm8JSMfeHbSUSGE3MSE+RenTksudO6mlGDOtnLiG0VtnDI37XKd0YI2HAKq:VVXUeHbxv89suQlAVtDD0YHgKvghR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7f:9c:b5:66:6d:4c:08:72:9d:51:f8:0b:bd:44:82:b9:cc:a2:3a:d9:c6:4a:92:3a:8c:4f:66:98:17:7e:6a:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 7, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

4b:e2:b3:6d:d3:ee:80:df:a2:f4:df:f5:4a:66:6f:b2:c6:37:15:4d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 7, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

14072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelibinf_db.dat

SHA256 0544403357dbff7551fc17f348a446d556a094d6c42e1121eb337de3ff88ca5c
MD5 ddc132992273330ec506e63fae4985b4
SHA1 7bf3018217f136662c159994f6530edf4c976a10
SHA512 fd1233c02cfd72116b92833810db084c1caa08530cdc0626a1e2fe035236b29348fdb4d89192aa473dec5ece5694017f3a3a46eda7f87c20a89cd07132f4d122
SSDEEP 1536:NO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1w:dNzXDFjvM25o2iHMWMzPZ0i6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelidb.dat

SHA256 ca5bb2f6c93eccc1ef5a2b2aae25b4976a2ce320a52d13d74f12b65205678e53
MD5 e12b4507919ef2d5b5f2b5332f7c2bb1
SHA1 4dd0c1870754a4052f9de5f09f69df3f7bae4b3d
SHA512 74a2e05077726ab00a810325d6be729c001f290977c9e4e3d81d3f4fe4398317698510a0bf5d5014625e5c740f11dc10cf004cac343cd1e4d8ab82908a0376ad
SSDEEP 1536:FO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1l:1NzXDFjvM25o2iHMWMzPZ0ib
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeml.dll

IMPHASH d45e3e670f326c83c96703480243c25f
SHA256 403866092dc4390df546399ee68ced2d1d1c0394b8769ef739fa7f240cefb385
MD5 3a200d0d84eb94f86868490c0261937b
SHA1 0563dd476b1d75195c164c6752276c0efc118081
SHA512 13416e2731006107500ee4c350e59b21897d42fd8e5cce18606a098be49fc24caa14b4e886bca995962920aac120316ae9e7d53688fac30022eeb2cbbbc88e63
SSDEEP 3072:/2TTkgqzVWX1P++4VTmlY7v/uoCi+X8QAVhy4ut5xZsmiVw:+TlP+HClYb/uoCF5ACCm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

03:79:58:e7:8e:dc:92:64:20:7f:59:66:0a:f3:4c:10:36:ea:1e:36:d6:47:cd:4c:47:f9:03:79:46:ce:cd:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 5, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

ad:a5:23:6e:4d:e4:26:44:61:8a:92:ca:02:d1:36:4b:f5:69:ba:1b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 5, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

54:09:d5:71:49:1d:e7:22:df:46:2f:a4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

50931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aemobile.dll

IMPHASH b9a9f12e7843764d45da446295f03e2a
SHA256 5096c9ab09e878d06596a20192d9b22ae7432bc660c8f4d8a24ea5daec509baf
MD5 ae3587d21cae5d74e438ee2492f65e72
SHA1 513ee522fb8e64312e99f1cc0b224bb315178532
SHA512 862e65c9122aa3f4d3155e995f586d13a93c5ccfaed6e637f34b5847bc178b80c9da51b9d9e3c3b03d61538ead7ad7ad03ab19e94a62f420da2ac62b7ceb060f
SSDEEP 6144:8NO19B3fnj21PJQs545pFFpMvqW7yCpPi+W25La9lIgUyff:8gvnj21Px5Ewq8LslF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

10:48:9b:f5:54:b9:cd:cb:20:aa:c7:7b:b5:7c:64:01:54:0a:d4:0b:74:54:eb:50:44:fb:e3:86:0c:64:bb:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Nov 9, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

c7:ac:83:4f:95:c4:ee:a6:d1:8a:93:84:16:87:20:d8:68:4a:fe:d7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 9, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

237696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice.dll

IMPHASH 06ae0e1fd5b99dde689ae499a2670f2f
SHA256 1c2a0d870f46575dfece1758809ac4d7f5e37fdb945a874512f99f275c4d2bc0
MD5 ade1cd616758d98b6940bff8a327c719
SHA1 899e7c2ba09039056b17d2bba0ac87cd2a60c224
SHA512 ad3249022c85851dadb717b0d1249b02eff89002004b98afa56c48b8c3d4de84a3345e0db95d387aef467bf80fb9250c9d73b580092b480bd96210e939535cd8
SSDEEP 12288:y8AvzivsdXkMME5zFVtuEDJvv01s+uUoTrTPe6sT54c:bkGvsdXdxp61s+uUoTrTPe68
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

03:73:25:b1:03:33:3a:a7:28:3d:e3:e1:60:6d:65:b9:d7:88:6d:de:1a:96:16:e0:e4:8c:a1:d7:5f:d4:f4:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 26, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

86:07:da:45:9c:5d:69:5e:07:91:b1:25:66:91:71:61:37:56:14:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 26, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

447258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_gwf.dat

SHA256 96e2488023689abf71cf9b951548420ff3ad9d6ff37116d4279a43b5b736968b
MD5 0c95def0894c5e5716cf7a3ecc7545a6
SHA1 51ce428514d454e7a428d57e3e050c1edad93a20
SHA512 2884dfc79a869b3e2db3f62340dccd3cee7746852006f67a26a26a4716ec719ba196627b18ddd775655b7baf954f668e9b5229297a4b87685f087e693184b369
SSDEEP 768:y6NQXRQOmhg0jm0fbaakNk8AWdp/2cqMgMYD82ew4uT7jKq:y6NQQi0jfGakNbAGX5gP82h4Iqq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_mv.dat

SHA256 2b5481a0d65c9a80a708aac3cb0ab281cd601d1274caf11517d821dbcbb9b4f1
MD5 0ce7e54204f99ef637b05ab9d78be36e
SHA1 3641faf0e2c345e61de14d34753ed26e32e9de6e
SHA512 4ac98f69f3e9895510571d4b9952f63394cf8c1e34a4cf8a44a28b1cecc1f23fbbf245e831c2bcfa801f16735e4e16e6f3158f2dce2738a9701b6e97975125a2
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aepack.dll

IMPHASH db61fd1ccd4070ba4964436e32dea996
SHA256 04936e1a579464228b0a04fe9b9808a2c94d60fd8f968261f8576ffb48ab8140
MD5 2d7f4f6b862c67d29f9acede3f87cf62
SHA1 cb205c9ab69ce9b11fd404c82278254e039391fd
SHA512 075501cd6a482b47b03c1c113246b3d9ed109966d9d944cc32708e60c4bdeddde562921f897a952341c9106b0794685d6638bd4505340b8079e75f0ea0bd5045
SSDEEP 24576:atz1KXoXhoY6pJ1LTwV969rMB0u604dHcUKP1Y4:atBBepJ1LH9BuxK0B
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

28:41:f2:33:e5:19:e0:55:f5:df:da:ca:63:57:d3:cf:ea:f4:7a:25:28:a9:1f:76:ed:53:42:11:5d:12:6c:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

9a:09:95:17:d4:5d:df:35:a9:c1:ef:10:49:0a:2d:f8:f1:bc:7b:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jul 27, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

687648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aerdl.dll

IMPHASH cc6d764effee6149756ba277acbb1c25
SHA256 f15ddc02864fce89707ec58b1f50ee5ab31be563da15d9d0e10c21746cb5f9cd
MD5 9b6b3cada9669f3b17ff9368f5f42148
SHA1 17a644be4542753bcebae09bff342c6e70e425cd
SHA512 3da00167dea05a34897ad17c236591b6dcb48bccd37ef2e29c52d15b8f5dd52cc53fe136129aab43ca39f2e5729746724ab9d4854cb021c298490a7c0ee5cc1d
SSDEEP 24576:amhFd3CHwCtScxrfKeDhYthlw/9X91UeF/0xR/1WoTikWa8a9gEng:2wCt2i/fmYQtDD9gEg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

24:4a:d6:5b:b2:f0:c6:f1:3b:f2:67:36:ba:27:0d:b8:ff:3f:33:f9:8a:a5:8d:39:d4:66:f2:87:8a:76:52:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

9b:e8:88:b0:f6:36:24:3e:1a:3d:85:d5:21:0e:5a:d2:0e:3e:d1:0d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Mar 2, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

923255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aesbx.dll

IMPHASH cc6d764effee6149756ba277acbb1c25
SHA256 1f568d08b101fa5407a56d9ce45c175be07796edd8db403f684f66a8ef492848
MD5 d984588795b6363c7166901e58b390d7
SHA1 8064803b24a58ccee1d472ec4138749ff917f20a
SHA512 1f5a8be0813ea0935de291d83aca412eb6b6de24729acd59aa55619c86d549ca9228b5586a3ea6c0b5490149fbadf0aad6d222434e248ae6c9f7609a1b4cc28a
SSDEEP 24576:Sj52e/EzQS+LZCBqn+eN6ZZn9cY+dnrwr91sQvjqr3:Co29SQMBeKEAHjW3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

10:db:f2:11:be:90:3f:f9:a3:0f:06:da:27:9d:50:cd:26:ab:b0:bf:d9:c4:1c:97:1c:67:c1:05:2a:da:0b:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

4c:59:90:55:60:0f:2a:72:fb:e5:e9:b1:d1:27:70:96:08:28:99:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Apr 2, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Serial Number

33:90:20:77:61:c4:26:dd:94:50:03:0d

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

1237134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aescn.dll

IMPHASH 44f9d837c62b89ef72663c75c40b9031
SHA256 6cbed7d2bfb842203cf05c9f43ad19280cafae9e5a40e846ad3844cf1d55d5d5
MD5 214b4c28771c952c5ceaa78803e0b6f5
SHA1 82c89b31860022e638ecd0aa08a87ec6c5c96cec
SHA512 cc2fecff4f8142ebc42db9771626ef7a4968f29a9cc70b26f6e4ee39e9684496ea65a5d19cc921b9c4aac63655d1698d076f44aab1eda01374b3e9a6255ddec2
SSDEEP 3072:olqZ5qxwY7ETXqPuKaJ7r9cGE9quTX4kp78kkp3tM5JG0YfF:sXxwYQGPl27xLoTom78tKGvfF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

90:43:b4:95:43:c9:cd:76:e7:e4:ad:9d:75:38:da:d4:86:e1:36:8b:7d:73:b8:2a:e3:8d:d4:fc:0a:45:bf:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 21, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

9a:0f:be:ab:27:ec:48:0c:ad:eb:00:d8:e1:59:a7:8c:27:e1:a0:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jun 21, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

ab:dd:67:65:f2:5a:ef:50:00:00:00:00:55:91:e9:0c

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 5, 2018 - Jan 5, 2030

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Minor OS version

0

Major OS version

4

Entry point

81889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aescript.dll

IMPHASH 9092dce3db7eacf36a41cb0b197c84da
SHA256 aba35f27e9285a17f9163c293cc666001302da3035f7791d032333dd41adbe86
MD5 0e93caf3c61398ebb511f711cc013e0c
SHA1 4a1ae4321ec388010d2f27434f6ee46f0b2f284e
SHA512 25a1d0f7fae2af6cac8b8f2cba25c348df243913352e8eccee0971c33cba9d20e6d83eb5595cbbfafb13c2dc0d75f2f6204005eb8d8a3e68dd0eacaec86f39a4
SSDEEP 24576:HCZQ3dK/6iapCIQJL81tQnHAY3R5VmSrM1/YI:iVuaJUtlYnASg+I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

49:98:54:7f:65:6e:99:2f:97:74:cb:e8:e5:40:fc:9c:6b:f7:86:65:98:97:97:9b:1b:ab:cf:96:6f:94:45:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 19, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

7b:9e:b3:f5:65:33:b6:0e:d0:29:f5:75:69:d7:ee:a8:87:4d:af:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 19, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

0

Major OS version

4

Entry point

968956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeset.dat

SHA256 2b897418cb59d00a89890c8c4c264ed383a24bf319b27043862ef952dee9a132
MD5 4c9ed5bf916808f45ee25456f977f4b6
SHA1 bc3101b75755a91ee25b757c547c59b998deecc8
SHA512 21bdd8790afb37417119782c46c6caf6789d79fd2ed04959f546028518ba29183be6bde4fa76a8da66e1656bc9b339e3f8c0f9b46eb77c77c26fea0fcee64fb3
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aevdf.dat

SHA256 4a12d2dbdea0ec6c98041ab78180e724be4ff5a441f5206a4d5b4bdf95c94963
MD5 a5061efe8e4dce49b7ac121b739e81c8
SHA1 b84a451c5ea7bb9b3ed14102341f9adff77d7d24
SHA512 dff902584971d28f58129edb2179c1a552c74541b23a9abc67924c0101cc3646c1df36d1738074dc4572d79db8cf08a053a7e2b3dcb18b6c1364766ea61dd605
SSDEEP 48:IZundhvs1U9JYcLaefVx7VL3CiV+35vnBvtpm5Mf/pLt3lREyAz6OFvbewRLIMwu:IZ8E1yaSVLOPOy5Qz6YeZLct7LGSkW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aevdf.dll

IMPHASH dbd46f388a9ed1e1a79f4f4b84c4df08
SHA256 d3d2ab463a7a8e014baa9380688db62bbde9a8ecc93c78206660d080636cff34
MD5 7a485eb8029ebcae86880bd41696627d
SHA1 5be46514383b6c736983a638896d57d363cdea21
SHA512 1d50c941247d08acd4a35852b2ba568713c3da2bbc91b682163066a3ce9a4fbe6530b138c187a6297237984f664f23755bac6e74432aeae0734defa128088f6e
SSDEEP 3072:g+rd2qTZPVeonYjc0FMTslGrLsyj072fin/2RBB9Zaa0cmc8o/7tRN397osFZP:gOdZVewL0rNozBKQZP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ff:96:bc:db:a1:13:8e:48:f1:2b:ed:c2:c7:53:92:d4:9e:35:cf:76:c6:b7:90:be:72:0a:5b:bf:78:fa:fa:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 18, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

35:ab:2d:a1:43:89:a9:be:c8:f8:8f:e8:7e:f5:fe:3f:bf:3d:dd:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 18, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

70314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/ams_setup.exe

IMPHASH b64e0d1107195a70b1f4b66a4095b2f4
SHA256 b28a92c1c971084a56fd71427e79ce08f5c504f13f4a78b39a6f75934156aed4
MD5 35f0a69eb13ff2c63722260091f1b220
SHA1 eb90188636d41ec44d2863ad5beb669ef25c7311
SHA512 d4e0362957d929325805bbb744789f0232ae4fb1710e202f04d757194d0d4194b1fe42fa93e5285e44f1945da85b24c55a812b484f5767303d2759d7b21da143
SSDEEP 3072:pb3raqcRjNrZoHmPlREYkLLaslQOM+FFSLJAK36ouukFYWoBT/WUURO9XZvTiJcg:pTetoHmLEzLLXQFmiD3idUJXZ+cg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

20:ba:2a:c1:4c:06:e0:6e:5e:80:c2:55:bc:b3:ff:6c:51:cf:f8:d3:90:3e:21:2c:a3:dd:da:08:84:03:fc:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

1

Major OS version

6

Entry point

29152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\utils\aviraoa\ams_setup\ams_setup.pdb

shlwapi

PathFileExistsW PathRemoveFileSpecW

user32

GetSystemMetrics ExitWindowsEx MessageBoxW

kernel32

CreateFileW WriteFile CopyFileW SetEnvironmentVariableW GetCurrentProcess GetBinaryTypeW HeapAlloc GetSystemTime GetProcessHeap GetEnvironmentVariableW GetFullPathNameW MoveFileExW SetFilePointerEx GetFileSizeEx LoadLibraryW FreeLibrary GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess WaitForSingleObject CloseHandle FindNextFileW FindFirstFileW FindClose DeleteFileW GetProcAddress GetModuleHandleW GetNativeSystemInfo LocalFree GetModuleFileNameW GetLocalTime GetLastError GetCommandLineW ReadFile ReadConsoleW HeapSize HeapReAlloc DecodePointer SetEndOfFile WriteConsoleW HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetStdHandle ExitProcess GetModuleHandleExW LCMapStringW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW

shell32

CommandLineToArgvW

advapi32

SetServiceObjectSecurity BuildExplicitAccessWithNameW SetEntriesInAclW QueryServiceObjectSecurity DeleteService CreateServiceW ChangeServiceConfig2W ChangeServiceConfigW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegQueryValueExW RegDeleteKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle FreeSid CheckTokenMembership AllocateAndInitializeSid

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/amswsccomm.dll

IMPHASH 90ca7a861c86e1e6d3fb23c54f549f2e
SHA256 8aa0e77fd794e5abb38daececff9334219499d32aded8a6304382d93ce07377d
MD5 1cef8dc4a1bc013e2072380f0c05fa85
SHA1 26a3144d6c5a5fe11b9276b34b4ddde70fe8391f
SHA512 eadb7a85d89b295f8d981da4c7f5be1b400c8ed8734fd70b5eac6fb8e79c8281371a0a57e056dfd820ba8279fa5e0c3ec25fb270a4ae8d9387ef5d4229f01cab
SSDEEP 12288:JnTfgEFlrP4SYxhdE77TsXOQtiUTSLxk1gH9JVbkX3b:JnTnFlrPlYxbGaOQtVTmk1i9Ja
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

e8:c9:2c:bf:bf:44:89:5d:57:50:3c:97:d7:b1:e6:0f:fc:2a:2f:89:ca:1e:51:ee:7e:aa:d8:8a:a5:4a:58:8a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 4, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

1

Major OS version

5

Entry point

50373

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\5x_rwgif\common\amswsccomm\libamswsccomm.pdb

shlwapi

PathFileExistsW

kernel32

ReadFile WriteFile CloseHandle CreateFileW PeekNamedPipe Sleep GetSystemTime WriteConsoleW HeapSize GetLastError GetCurrentThread FlushFileBuffers GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer QueryPerformanceCounter CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEvent WaitForSingleObjectEx SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RaiseException RtlUnwind GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW GetFileType GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetEndOfFile SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetStdHandle GetTimeZoneInformation IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetCurrentDirectoryW GetFullPathNameW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW

crypt32

CryptProtectData CryptUnprotectData

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/apc_random_id_generator.exe

IMPHASH b1ef39e19e7edc44a55fb07e315cf760
SHA256 b01a44e0fb9e01ffc4446d60736ff784d8ada511484e107bad1e66d3cc1d59a8
MD5 ceee905a278dc72f407b4af32366089d
SHA1 3a16c14eb27fdc8ff93a5123b45bb599f4762925
SHA512 519496fb33db80456eddbf3601018735da58855a88d01b17f04043c4f542c28b7ba5bc61b9a9314934ebd00c4b09d9b2b1e8d4f12e3cff1679fb0191e72c4b89
SSDEEP 6144:aLL+IGzcYlBZbld+Hcso5fLuUZdvXwDwY4khotAKyjH6S9uuLH2JDsQ8cNdkhB:aLL+IGzcoBZbldJJ7XwDwY4khotAKdSP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

6f:7d:e8:5d:bd:2b:83:60:48:ca:42:cb:1a:b4:79:dc:7b:e4:22:27:cb:6b:34:4a:b7:f7:65:80:4e:29:91:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 28, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 2, 2021 - Mar 6, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

122384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\r5hd573d\utils\apc\random_id_gen\apc_random_id_generator.pdb

ws2_32

accept getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername WSAGetLastError socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind ntohl

rpcrt4

UuidCreate

kernel32

ReadConsoleW GetConsoleMode LCMapStringW CompareStringW SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime GetLastError LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection EnterCriticalSection GetConsoleCP TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetStdHandle GetHandleInformation SetHandleInformation WaitForMultipleObjects GetCurrentProcessId GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW WriteConsoleW CreateFileA GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue GetVersionExA GetModuleFileNameA GetProcAddress LoadLibraryA SetEndOfFile LockFile LockFileEx UnlockFile UnlockFileEx DuplicateHandle GetCurrentProcess CreatePipe CreateNamedPipeA FormatMessageA SetFilePointerEx HeapReAlloc DecodePointer FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap HeapSize LeaveCriticalSection CreateHardLinkW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW RaiseException GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/apcfile.dll

IMPHASH 09581c73a9cfd8879440aa7e36eb5df9
SHA256 042048cdcba5647c8ba28fe682e0d6eda5543220fdcedd6908527f339441cd81
MD5 f1eea993b439b952f46948021fe8a2de
SHA1 f62b8626bd1799c85b94743e0278d2b01b60de95
SHA512 817e763ed7f13b020d3f9f345e708eface3e4227ab57ce30f5bddf1f2f1cf7ce2ae82ebfb3ac3c20ba08d7b009d92bcc07d68c5c3fc2d0afedc0cdaebc4023c7
SSDEEP 49152:wwqo4YFwoDpGgg7anyhBE4KJXW4GezlmqelpnbcDHI1SP0kootlFHopCb1XKc:wwqoFwJgg7anyhBEZkpMl3elpbcDHeQp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

9b:94:35:b9:f2:6c:15:ec:b8:d5:c3:f0:aa:c1:88:e5:a5:10:aa:3e:2e:00:76:81:5a:20:2c:1e:b2:6d:17:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

1

Major OS version

6

Entry point

1969736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\utils\apc\sdk\sdk\src\build_apc-build\bin\apcfile.pdb

netapi32

NetApiBufferFree NetUserEnum

ws2_32

inet_addr WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getservbyname shutdown ntohl getnameinfo gethostname freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError setsockopt ntohs htons getsockopt getsockname getpeername connect bind inet_pton send recv WSAGetLastError socket closesocket

mswsock

TransmitFile

rpcrt4

UuidCreate

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

kernel32

SetConsoleCtrlHandler GetModuleFileNameW ExitThread WriteConsoleW SetEnvironmentVariableW GetConsoleCP SetFilePointerEx HeapFree HeapAlloc GetDateFormatW GetTimeFormatW FreeLibraryAndExitThread GetCurrentProcessId GetModuleHandleW GetProcAddress GetCurrentProcess GetVersionExW GetLocaleInfoA GetLastError SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetTickCount Sleep MoveFileExA CloseHandle WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoA GetEnvironmentVariableW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageW GetFileType WriteFile SwitchToFiber DeleteFiber CreateFiber LoadLibraryW ConvertFiberToThread ConvertThreadToFiber FindClose FindFirstFileW GetSystemTime SystemTimeToFileTime GetACP GetOEMCP SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation InitializeCriticalSection TryEnterCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA DuplicateHandle SwitchToThread GetCurrentThread ReleaseSemaphore CreateSemaphoreA ResetEvent FindFirstFileA GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetStdHandle CreateFileW DeleteFileW SetFilePointer GetOverlappedResult CancelIo MoveFileExW CreateHardLinkW CreateDirectoryW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GlobalFree SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile PeekNamedPipe SetHandleInformation GetSystemInfo MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileA GetVersionExA GetModuleFileNameA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwind HeapReAlloc OutputDebugStringW IsValidCodePage FindFirstFileExW GetCommandLineA GetProcessHeap HeapSize CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes VirtualAlloc VirtualProtect VirtualFree InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx FindNextFileW DeviceIoControl GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW EncodePointer DecodePointer RaiseException GetStringTypeW CompareStringW LCMapStringW

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource

bcrypt

BCryptGenRandom

apc_add_cache apc_authenticate apc_category_name apc_create_context apc_ctx_get_file_lookup_filter apc_ctx_get_user_data apc_ctx_set_connection_timeout apc_ctx_set_data_timeout apc_ctx_set_file_lookup_filter apc_ctx_set_upload_connection_timeout apc_ctx_set_upload_data_timeout apc_ctx_set_user_data apc_disable_logging apc_enable_logging apc_file_auth_checker_callback_set apc_file_cache_disable apc_file_cache_enable apc_file_cancel_uploads apc_file_check_file apc_file_check_files apc_file_check_files_ex apc_file_check_hash apc_file_check_hash_ex apc_file_check_hashes apc_file_check_hashes_ex apc_file_ctx_call_filters apc_file_ctx_get_elf_mode apc_file_ctx_get_ext apc_file_ctx_get_ext_policy apc_file_ctx_get_filters apc_file_ctx_get_mac_mode apc_file_ctx_get_pe_mode apc_file_ctx_hash apc_file_ctx_set_elf_mode apc_file_ctx_set_ext apc_file_ctx_set_ext_policy apc_file_ctx_set_filters apc_file_ctx_set_fops apc_file_ctx_set_mac_mode apc_file_ctx_set_pe_mode apc_file_ctx_set_temporary_dir apc_file_hash apc_file_hash_ex apc_file_info_get_extra_info apc_file_info_get_malware_name apc_file_initialize apc_file_initialize_context apc_file_metadata_set_download_url apc_file_quota_callback_set apc_file_set_batch_service apc_file_set_temporary_dir apc_file_set_upload_threadpool_limits apc_file_uninitialize apc_file_uninitialize_context apc_file_unwilling_to_upload apc_file_wait_for_uploads apc_file_willing_to_upload apc_free_context apc_get_file_lookup_filter apc_get_library_version apc_load_cache apc_save_cache apc_set_cache_dump_secure apc_set_connection_retries apc_set_connection_timeout apc_set_data_timeout apc_set_file_lookup_filter apc_set_low_upload_speed_limit apc_set_low_upload_speed_time apc_set_max_cache_size apc_set_max_upload_speed apc_set_metadata_product_id apc_set_metadata_product_language apc_set_metadata_product_license apc_set_metadata_product_random_id apc_set_metadata_product_version apc_set_out_of_memory_handler apc_set_proxy apc_set_proxy_auth apc_set_server_message_cb apc_set_service_address apc_set_ssl_ca_cert apc_set_ssl_crl apc_set_upload_connection_retries apc_set_upload_connection_timeout apc_set_upload_data_timeout apc_ssl_threads_initialize apc_ssl_threads_uninitialize apc_strerror

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/apchash.dll

IMPHASH 8ea6ceb7eea753a493da5f19453ffe74
SHA256 5e935a9ccd8458312a22b26b4a726861567376ee3d82d4255a03f3efb84f59e1
MD5 7a380e745b99473911cc6bd0e0fd1743
SHA1 3e2c3f7c34025f358f2cf963ab02eb8e1fd3ebfa
SHA512 be5188a38ce107d4d4f500bc5e2a0fcc9f5dbba73938d68c2278af42ef15e1b1a282c05f56a6db265b24a35ed109e724e82a0a329e3fd24ab615dae80ee52303
SSDEEP 3072:oyIIII79fgE9rzlJhSeVv1bT/NqjXG4wBfJVbrfWzSFbrzRTCoEEbNPCs8ywd6:zIIII797dJgUFqDUmz4vzyE89M
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

3f:d1:89:bc:e9:9c:cf:62:98:90:d6:25:da:69:b7:0a:3e:88:d4:64:06:72:90:bb:88:c0:5c:27:54:b7:b4:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

30424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\utils\apc\libapc_hash\apchash.pdb

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate-savapilib-engine.conf

SHA256 5c073f2195c20ba9e30e9013f99d1461b7e12d34a3920fc96f4877c9c44ea5da
MD5 5410d22ecaf5de79e5bc31d298b20c90
SHA1 1656b8e2ca74a4fcaad70859c113abf30a3aadaf
SHA512 d47edb1660d1ac5104462d8f2a52b1549814beeaa12fe30bb54350a0e10405b6fcf13dd709b25b730e590b1ada88ba0105644d32dcd7f958a0c67aaf9078101d
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate.exe

IMPHASH 98391639ecf68510bcf6270cbf1d9dce
SHA256 d83f9e625f5756775a6c737426d4408af9d77d03f812850ebb096a4127f832d5
MD5 1fe10e77dfbb3d61c694d2ebe19ecf3f
SHA1 8380157b09c578b13536887a94e3a5a927f2b2ae
SHA512 7c1159ed9a81786d76312ae50624029ad0ba436a7e20f78af610cda59c483897b7b74c8a1ececfdce5ce1dc8d89abdc5ed28e38986f5e0a3ef99640636a818eb
SSDEEP 49152:X8vIWDYXCsWpXC+cWgg7anyhBZ31oEiiojQ7TWh3zdPCDo3rD62eLV:X8vfYXxWpXlgg7anyhBZaEiiojbpzcD1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1d:fc:41:fd:fe:3e:1e:d8:04:fd:c4:4e:db:c2:0f:a2:47:9f:bb:88:3e:9b:29:ec:3e:44:cf:7d:90:50:a6:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 26, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

2007284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\fe4_3woi\updater\avupdate.pdb

scew

scew_element_by_name scew_strcmp scew_element_attributes scew_element_children XML_Parse scew_list_next scew_list_data scew_element_attribute_by_name scew_parser_ignore_whitespaces scew_parser_free scew_parser_create scew_tree_set_root scew_tree_create scew_attribute_value scew_attribute_name scew_element_add_attribute_pair scew_element_add_element scew_element_add scew_element_count scew_element_set_contents scew_element_free scew_element_create scew_tree_root scew_element_contents scew_element_name scew_tree_free

ws2_32

closesocket WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getservbyname ntohl getnameinfo shutdown gethostbyname gethostname freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket inet_addr recv send setsockopt ntohs htons getsockopt getsockname getpeername connect bind inet_pton WSAGetLastError

mswsock

TransmitFile

rpcrt4

UuidCreate

shell32

CommandLineToArgvW SHGetFolderPathW

mpr

WNetAddConnection2W WNetCancelConnection2W

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptCreateHash OpenProcessToken GetTokenInformation LookupAccountSidW SetThreadToken DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegCloseKey CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash GetUserNameW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW ReportEventW RegisterEventSourceW DeregisterEventSource

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

SetEvent TryEnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW WaitForMultipleObjects InitializeCriticalSection GetHandleInformation SetEndOfFile SetEnvironmentVariableW SetFileTime SetFileAttributesW GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindFirstFileA CreateEventA PeekNamedPipe CreateSemaphoreA CancelIo DeviceIoControl SetFilePointer GetFileInformationByHandle DeleteFileW SetStdHandle LoadLibraryExW SetErrorMode RemoveDirectoryW CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFullPathNameW DuplicateHandle SwitchToThread GetCurrentThread CreateFileA GetVersionExA GetModuleFileNameA LockFile ReleaseMutex UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EncodePointer RaiseException ExitProcess GetModuleHandleExW SetConsoleCtrlHandler CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleCP WriteConsoleW GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc GetDriveTypeW GetDriveTypeA GetCurrentDirectoryW SetCurrentDirectoryW ConvertThreadToFiber ConvertFiberToThread CreateMutexA LockFileEx ReleaseSemaphore DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetStringTypeW GetProcessHeap ReadConsoleInputW FlushFileBuffers FreeLibrary GetLastError GetLocaleInfoW MoveFileExW LocalFree FormatMessageW CreateFileW ReadFile CloseHandle SetHandleInformation CreateNamedPipeW GetOverlappedResult ResetEvent WaitForSingleObject CreateEventW TerminateProcess GetExitCodeProcess CreateProcessW HeapSize GetProcAddress LoadLibraryW GlobalFree GetCurrentProcessId OpenProcess GlobalAlloc GetComputerNameW GetVersionExW GetCurrentThreadId GetModuleFileNameW GetModuleHandleW GetCurrentProcess GetSystemDirectoryW GetWindowsDirectoryW IsWow64Process LoadLibraryA MultiByteToWideChar SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA QueryPerformanceCounter GetTickCount Sleep WideCharToMultiByte MoveFileExA WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoA GetTimeZoneInformation CreateHardLinkW GetACP GetOEMCP GetStdHandle GetConsoleScreenBufferInfo GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW GetSystemTime SystemTimeToFileTime GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW GetFileType WriteFile

bcrypt

BCryptGenRandom

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate_msg.avr

SHA256 aa245a1518edd42f88f17b943a4d128810b1d371b09ca49d1b17ca36bc4a1727
MD5 99a82442c65cb314838ccd27db19a51f
SHA1 f77a75f07695dae310e6f05816c21ecf3aa54b08
SHA512 d8a2601a049eac4237d2ed65eea4fa5a808ba3288fe5795b0235ae574dffa20b84dd39d64344e778615265621545b7ccd07943fccd9892bd94b53ea9cd401b89
SSDEEP 96:7+rz/vx3SFRuC9nNKZRllhXBpQisZ3i5hSAFCLYIFrGZk2Z+5ZDSLW2vnv13Srv7:qiFRuCJNKzRxw3i5hSAIbyrZ+7wnU7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/cacert.crt

SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
MD5 9956b172b62aeb41ca988999947a488e
SHA1 199e3607abeafd168b02b062697656a847fe4de7
SHA512 5d365e0b88a15b43bf84650f0e98bb05fd6e0257cbd73b2227bc27b94cad3086df2a65fa227ddfdf484447d91297c48800a1ed111a6bc880da53195b8657f189
SSDEEP 96:LrBwgYufFy6nfwJeMmFtBuyuCk+Plvz49wC5UnhVhdnZrYGjWwbhliiuD:HBwgY2FLfFpbunCXlv09wfnXhNZrXxfq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/AMSAgent.exe

IMPHASH 2157780a8f0ae11fe3cdbf455db7e287
SHA256 429092df22f0312932d79529a872494cb271888c80de8522b4186b4005775d40
MD5 a3deb4d720484b67ea8e417cbf3e98b8
SHA1 1f8b3152397812ccdb2db9a1aca756aef68d3e74
SHA512 c1ab72eb11bf9c3a51c78b16e665c5922881be3de4b7caf31612b65411b648adfe90c6b1a41208bc81f37242ad56035c6ed0ab08fcce5f458de4b24eeb579167
SSDEEP 24576:FrJssaNT1+u+dM5ELn7XS6bW9eKKce1THOhqt2IoeVMP/P+QQ4yv:FrJsFNQuB5EL7XSeROqt2IP8/PpQ4yv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

4c:91:52:e4:ed:ed:60:25:e8:18:1f:77:f1:ba:48:f3:9a:3e:08:17:c6:05:c8:01:38:f1:57:98:3a:b9:b9:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

387591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV-BARW\AV\BuildOutput\Bin\Release\amsagent.exe.pdb

kernel32

OpenProcess FreeLibrary GetProcAddress LoadLibraryW K32GetModuleFileNameExW K32GetProcessImageFileNameW CompareFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation WideCharToMultiByte GetDateFormatW GetTimeFormatW GetLocaleInfoW GetSystemDefaultUILanguage GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection UpdateProcThreadAttribute InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer GetCPInfo TryEnterCriticalSection CompareStringW LCMapStringW SetEvent ResetEvent IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess InitializeSListHead OutputDebugStringW WriteConsoleW SetEndOfFile HeapSize CreateProcessW GetCurrentThread GetExitCodeProcess GetCurrentProcessId GetCurrentProcess WaitForSingleObject GetProcessHeap HeapAlloc CloseHandle QueryDosDeviceW CreateFileW FormatMessageW LocalFree MultiByteToWideChar GetModuleFileNameW DecodePointer GetTickCount64 Sleep GetLocalTime DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException SetLastError SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetConsoleCtrlHandler ReadConsoleW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlUnwind GetDriveTypeW GetFullPathNameW ExitThread ResumeThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapFree GetFileType HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetCurrentDirectoryW GetCurrentDirectoryW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx RtlCaptureStackBackTrace

user32

UnregisterClassW

advapi32

ChangeServiceConfigW StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenThreadToken OpenProcessToken TraceMessage

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoInitializeSecurity

shell32

ShellExecuteExW

oleaut32

VariantInit SysStringLen SysFreeString SysAllocString VariantClear SysAllocStringLen

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/AMSProtectedService.exe

IMPHASH 78381432291e84e8d63e36c28bde989c
SHA256 98fcbacccd356a5309626a0cfd398702f5f2b582e0ceddbc8aab55dac1a0271d
MD5 831dd67d23fd157956b010ac05f1b162
SHA1 f509362297d79f85a25e66df5cfd720bd3fe3cf0
SHA512 b044ad38f78a15eb387654f653524987aaf82371e47558d947b7d0cc8910dc22d750fdded549fb9931c7318012ca1afd437394f00d976bf938116d3e469b99e4
SSDEEP 12288:k7NMkvTvIrlhqbfYHdled/51eqrNXF7+yHdnjLv0JvNQsHskP5U6Bo1+N00KX+l:k7NLQx8bfYHbedR1eqBXUSlv0JNTMkP3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

b6:47:ad:f5:a4:0a:72:0e:4c:26:81:08:ba:aa:85:15:0b:23:eb:86:cd:fb:e8:fd:28:58:3e:0f:10:d1:4d:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

1

Major OS version

5

Entry point

197044

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV-BARW\AV\BuildOutput\Bin\Release\amsprotectedservice.exe.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime UpdateProcThreadAttribute SystemTimeToFileTime GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte GetDateFormatW GetTimeFormatW GetLocaleInfoW SetEndOfFile CreateProcessW GetCurrentThread GetCurrentProcessId GetCurrentProcess CreateFileW FormatMessageW LocalAlloc CreateThread WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent GetProcessHeap HeapFree HeapAlloc CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe CloseHandle WriteFile ReadFile FlushFileBuffers GetCurrentDirectoryW GetModuleFileNameW WriteConsoleW HeapSize ReadConsoleW SetStdHandle SetEnvironmentVariableW GetLastError FileTimeToSystemTime CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP GetStringTypeW QueryPerformanceCounter WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread TryEnterCriticalSection SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetFileType GetFileSizeEx SetFilePointerEx GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CloseServiceHandle RegSetValueExA RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey AllocateAndInitializeSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW SetEntriesInAclW QueryServiceConfig2W OpenServiceW OpenSCManagerW ChangeServiceConfig2W

crypt32

CryptUnprotectData CryptProtectData

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/concrt140.dll

IMPHASH 9119c3c59302a28e52b3bffe18f55f1d
SHA256 6567e9d90e91c3a146f1b9b6f30b2ab6ba04df11991647941b750bc141a718c0
MD5 cbaa2b13d56ebe7426e7d705e68bc0a1
SHA1 a866f6d22156b3628a7178cc72fc9f7e1dd94614
SHA512 b637a48144160b08fdd2c5f8702224e73a89cbacccef2e3f3190118f375285498161f680f66239de99d1fa0d75a86e95592f5386ff36e401c1fad6b1ff438b90
SSDEEP 6144:t2ALMk1VUyYI1hG3QYFruh7o/ehe1fjpsRV8JC0yD7+Rk6WvbZLl12z/gulAL:K8inIe1f2P7nFSz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

05:69:ad:d9:b5:61:3c:5d:3c:d6:42:75:4e:b9:87:71:99:61:a2:44:01:e4:8c:8c:60:47:59:76:e8:3d:71:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

169440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin\i386\\concrt140.i386.pdb

msvcp140

__crtCloseThreadpoolWait ?_Xbad_function_call@std@@YAXXZ __crtSetThreadpoolWait __crtCreateThreadpoolWait __crtCloseThreadpoolTimer __crtWaitForThreadpoolTimerCallbacks __crtCreateThreadpoolTimer ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z __crtSetThreadpoolTimer __crtCreateSemaphoreExW __crtGetCurrentProcessorNumber __crtFlushProcessWriteBuffers __crtGetTickCount64 __crtCreateEventExW __crtInitializeCriticalSectionEx ?_Throw_C_error@std@@YAXH@Z _Cnd_broadcast _Cnd_wait _Cnd_destroy_in_situ _Cnd_init_in_situ _Mtx_unlock _Mtx_lock _Mtx_destroy_in_situ _Mtx_init_in_situ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ __crtFreeLibraryWhenCallbackReturns

vcruntime140

_purecall __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memset __uncaught_exception memcpy __RTDynamicCast _except_handler4_common __std_type_info_destroy_list __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_cexit _initialize_narrow_environment _initterm_e _seh_filter_dll _initterm _invalid_parameter_noinfo_noreturn _configure_narrow_argv _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit terminate

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

api-ms-win-crt-math-l1-1-0

_CIsqrt _CIexp

api-ms-win-crt-string-l1-1-0

wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __stdio_common_vswprintf_s fflush __acrt_iob_func

kernel32

SetLastError DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait Sleep GetCurrentThreadId GetCurrentProcess WaitForSingleObjectEx SetEvent GetLastError DuplicateHandle CloseHandle GetCurrentThread CreateTimerQueue QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetProcAddress GetNumaHighestNodeNumber DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread FreeLibrary GetThreadTimes OutputDebugStringW LoadLibraryW LoadLibraryExW GetModuleHandleW EncodePointer UnregisterWaitEx ReleaseSemaphore InitializeSListHead SetProcessAffinityMask VirtualFree VirtualProtect VirtualAlloc GetVersionExW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask

??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z ??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z ??0SchedulerPolicy@Concurrency@@QAA@IZZ ??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z ??0SchedulerPolicy@Concurrency@@QAE@XZ ??0_Cancellation_beacon@details@Concurrency@@QAE@XZ ??0_Concurrent_queue_base_v4@details@Concurrency@@IAE@I@Z ??0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@ABV_Concurrent_queue_base_v4@12@@Z ??0_Condition_variable@details@Concurrency@@QAE@XZ ??0_Context@details@Concurrency@@QAE@PAVContext@2@@Z ??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_ReaderWriterLock@details@Concurrency@@QAE@XZ ??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_ReentrantLock@details@Concurrency@@QAE@XZ ??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_Runtime_object@details@Concurrency@@QAE@H@Z ??0_Runtime_object@details@Concurrency@@QAE@XZ ??0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_SpinLock@details@Concurrency@@QAE@ACJ@Z ??0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@XZ ??0_Timer@details@Concurrency@@IAE@I_N@Z ??0agent@Concurrency@@QAE@AAVScheduleGroup@1@@Z ??0agent@Concurrency@@QAE@AAVScheduler@1@@Z ??0agent@Concurrency@@QAE@XZ ??0bad_target@Concurrency@@QAE@PBD@Z ??0bad_target@Concurrency@@QAE@XZ ??0context_self_unblock@Concurrency@@QAE@PBD@Z ??0context_self_unblock@Concurrency@@QAE@XZ ??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z ??0context_unblock_unbalanced@Concurrency@@QAE@XZ ??0critical_section@Concurrency@@QAE@XZ ??0default_scheduler_exists@Concurrency@@QAE@PBD@Z ??0default_scheduler_exists@Concurrency@@QAE@XZ ??0event@Concurrency@@QAE@XZ ??0improper_lock@Concurrency@@QAE@PBD@Z ??0improper_lock@Concurrency@@QAE@XZ ??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_attach@Concurrency@@QAE@XZ ??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_detach@Concurrency@@QAE@XZ ??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z ??0improper_scheduler_reference@Concurrency@@QAE@XZ ??0invalid_link_target@Concurrency@@QAE@PBD@Z ??0invalid_link_target@Concurrency@@QAE@XZ ??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z ??0invalid_multiple_scheduling@Concurrency@@QAE@XZ ??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z ??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ ??0message_not_found@Concurrency@@QAE@PBD@Z ??0message_not_found@Concurrency@@QAE@XZ ??0missing_wait@Concurrency@@QAE@PBD@Z ??0missing_wait@Concurrency@@QAE@XZ ??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z ??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ ??0operation_timed_out@Concurrency@@QAE@PBD@Z ??0operation_timed_out@Concurrency@@QAE@XZ ??0reader_writer_lock@Concurrency@@QAE@XZ ??0scheduler_not_attached@Concurrency@@QAE@PBD@Z ??0scheduler_not_attached@Concurrency@@QAE@XZ ??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z ??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@J@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z ??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0unsupported_os@Concurrency@@QAE@PBD@Z ??0unsupported_os@Concurrency@@QAE@XZ ??1SchedulerPolicy@Concurrency@@QAE@XZ ??1_Cancellation_beacon@details@Concurrency@@QAE@XZ ??1_Concurrent_queue_base_v4@details@Concurrency@@MAE@XZ ??1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@XZ ??1_Concurrent_vector_base_v4@details@Concurrency@@IAE@XZ ??1_Condition_variable@details@Concurrency@@QAE@XZ ??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_SpinLock@details@Concurrency@@QAE@XZ ??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ ??1_TaskCollection@details@Concurrency@@QAE@XZ ??1_Timer@details@Concurrency@@MAE@XZ ??1agent@Concurrency@@UAE@XZ ??1critical_section@Concurrency@@QAE@XZ ??1event@Concurrency@@QAE@XZ ??1reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock@critical_section@Concurrency@@QAE@XZ ??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@$$QAV012@@Z ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@$$QAV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z ??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z ??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ ??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ ??_F_Context@details@Concurrency@@QAEXXZ ??_F_Scheduler@details@Concurrency@@QAEXXZ ?AgentEventGuid@Concurrency@@3U_GUID@@B ?Alloc@Concurrency@@YAPAXI@Z ?Block@Context@Concurrency@@SAXXZ ?ChoreEventGuid@Concurrency@@3U_GUID@@B ?ConcRTEventGuid@Concurrency@@3U_GUID@@B ?ConcRT_ProviderGuid@Concurrency@@3U_GUID@@B ?ContextEventGuid@Concurrency@@3U_GUID@@B ?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z ?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ ?CurrentContext@Context@Concurrency@@SAPAV12@XZ ?Detach@CurrentScheduler@Concurrency@@SAXXZ ?DisableTracing@Concurrency@@YAJXZ ?EnableTracing@Concurrency@@YAJXZ ?Free@Concurrency@@YAXPAX@Z ?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ ?GetExecutionContextId@Concurrency@@YAIXZ ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ ?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z ?GetProcessorCount@Concurrency@@YAIXZ ?GetProcessorNodeCount@Concurrency@@YAIXZ ?GetSchedulerId@Concurrency@@YAIXZ ?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ ?Id@Context@Concurrency@@SAIXZ ?Id@CurrentScheduler@Concurrency@@SAIXZ ?IsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ ?LockEventGuid@Concurrency@@3U_GUID@@B ?Log2@details@Concurrency@@YAKI@Z ?NFS_Allocate@details@Concurrency@@YAPAXIIPAX@Z ?NFS_Free@details@Concurrency@@YAXPAX@Z ?NFS_GetLineSize@details@Concurrency@@YAIXZ ?Oversubscribe@Context@Concurrency@@SAX_N@Z ?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B ?PPLParallelForeachEventGuid@Concurrency@@3U_GUID@@B ?PPLParallelInvokeEventGuid@Concurrency@@3U_GUID@@B ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ ?ResourceManagerEventGuid@Concurrency@@3U_GUID@@B ?ScheduleGroupEventGuid@Concurrency@@3U_GUID@@B ?ScheduleGroupId@Context@Concurrency@@SAIXZ ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z ?SchedulerEventGuid@Concurrency@@3U_GUID@@B ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z ?VirtualProcessorEventGuid@Concurrency@@3U_GUID@@B ?VirtualProcessorId@Context@Concurrency@@SAIXZ ?Yield@Context@Concurrency@@SAXXZ ?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXXZ ?_Assign@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXABV123@@Z ?_Byte_reverse_table@details@Concurrency@@3QBEB ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ ?_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z ?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ ?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ ?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ ?_Current_node@location@Concurrency@@SA?AV12@XZ ?_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ ?_GetCombinableSize@details@Concurrency@@YAIXZ ?_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ ?_GetConcurrency@details@Concurrency@@YAIXZ ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ ?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ ?_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ ?_Internal_assign@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXI@ZP6AX1PBXI@Z4@Z ?_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IBEIXZ ?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IAEIP6AXPAXI@Z@Z ?_Internal_compact@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIPAXP6AX0I@ZP6AX0PBXI@Z@Z ?_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXPBXI@Z@Z ?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IBE_NXZ ?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IAEXXZ ?_Internal_grow_by@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z ?_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z ?_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPAX@Z ?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IAE_NPAX@Z ?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPBX@Z ?_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIAAI@Z ?_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIII@Z ?_Internal_resize@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIIIP6AXPAXI@ZP6AX0PBXI@Z2@Z ?_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IBEIXZ ?_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IAEXAAV123@@Z ?_Internal_swap@_Concurrent_vector_base_v4@details@Concurrency@@IAEXAAV123@@Z ?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IBEXXZ ?_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IBEXI@Z ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ ?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ ?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_Reference@_Scheduler@details@Concurrency@@QAEIXZ ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_Scheduler@details@Concurrency@@QAEIXZ ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z ?_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KAII@Z ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ ?_SpinYield@Context@Concurrency@@SAXXZ ?_Start@_Timer@details@Concurrency@@IAEXXZ ?_Stop@_Timer@details@Concurrency@@IAEXXZ ?_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ ?_UnderlyingYield@details@Concurrency@@YAXXZ ?_Value@_SpinCount@details@Concurrency@@SAIXZ ?_Yield@_Context@details@Concurrency@@SAXXZ ?cancel@agent@Concurrency@@QAE_NXZ ?current@location@Concurrency@@SA?AV12@XZ ?done@agent@Concurrency@@IAE_NXZ ?from_numa_node@location@Concurrency@@SA?AV12@G@Z ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ ?is_current_task_group_canceling@Concurrency@@YA_NXZ ?lock@critical_section@Concurrency@@QAEXXZ ?lock@reader_writer_lock@Concurrency@@QAEXXZ ?lock_read@reader_writer_lock@Concurrency@@QAEXXZ ?native_handle@critical_section@Concurrency@@QAEAAV12@XZ ?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ ?notify_one@_Condition_variable@details@Concurrency@@QAEXXZ ?reset@event@Concurrency@@QAEXXZ ?set@event@Concurrency@@QAEXXZ ?set_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z ?set_task_execution_resources@Concurrency@@YAXK@Z ?start@agent@Concurrency@@QAE_NXZ ?status@agent@Concurrency@@QAE?AW4agent_status@2@XZ ?status_port@agent@Concurrency@@QAEPAV?$ISource@W4agent_status@Concurrency@@@2@XZ ?try_lock@critical_section@Concurrency@@QAE_NXZ ?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ ?try_lock_for@critical_section@Concurrency@@QAE_NI@Z ?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ ?unlock@critical_section@Concurrency@@QAEXXZ ?unlock@reader_writer_lock@Concurrency@@QAEXXZ ?wait@Concurrency@@YAXI@Z ?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z ?wait@agent@Concurrency@@SA?AW4agent_status@2@PAV12@I@Z ?wait@event@Concurrency@@QAEII@Z ?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z ?wait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z ?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z ?wait_for_one@agent@Concurrency@@SAXIPAPAV12@AAW4agent_status@2@AAII@Z

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/mfc140u.dll

IMPHASH 087250bec47ae040f63b84ccb2ebd086
SHA256 be03d1dabf873ebe9790e955e63229c8d00cf1ffb4f15cf9a114c6951522a7ad
MD5 2b05c61f3c97b3926d871ef073d2b737
SHA1 b45a22ebc5c8ad4bce1b5cc8f2eac62a55852a3c
SHA512 ae07c5bc3f346ccb773eda796583dec3cd2a213fbe2cd31cf8759a12c508ffed595ef8eff79b36241e0784a201989a0ea5f0e8f1c847f9201367d55c44143018
SSDEEP 98304:geAM+5SzS7t2x6aaZlQk3yXujcPLb71vrQ4XOE07MmretFLOAkGkzdnEVomFHKnR:I5SzCtXN871Xn07MmOFLOyomFHKnPws/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

e4:5f:81:3c:0e:e5:df:c3:c3:20:29:c9:e5:35:e1:db:05:f4:80:9c:44:85:d4:c3:c4:bd:e0:54:ce:cf:76:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

549664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin_spectre\i386\mfc140u.i386.spectre.pdb

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumValueW RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegQueryValueW RegSetValueW GetFileSecurityW SetFileSecurityW IsTextUnicode RegOpenKeyExA RegQueryValueExA

kernel32

IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess QueryPerformanceCounter UnhandledExceptionFilter LoadLibraryExA ExpandEnvironmentStringsA GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter LockResource LoadResource FindResourceW GetLastError InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetLastError GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW GetModuleFileNameW OutputDebugStringA MultiByteToWideChar lstrcpyW GlobalAlloc GlobalLock GlobalUnlock GetCurrentThreadId InitializeCriticalSection DeleteFileW MulDiv VerSetConditionMask VerifyVersionInfoW FreeLibrary CloseHandle GetTempPathW CreateFileW SetFilePointer Sleep GetCurrentDirectoryW lstrcmpW GetSystemDirectoryW LoadLibraryExW DecodePointer EncodePointer GlobalFree GetTickCount GetWindowsDirectoryW lstrcmpiW SetThreadPriority LocalAlloc LocalFree TlsAlloc TlsFree GlobalHandle GlobalReAlloc TlsGetValue LocalReAlloc TlsSetValue GetFileSize GetFileAttributesW GlobalSize SearchPathW GetLocaleInfoW GetUserDefaultUILanguage OutputDebugStringW GetSystemInfo VirtualQuery GetSystemDefaultUILanguage FormatMessageA GetEnvironmentVariableA GetEnvironmentVariableW GlobalFlags GlobalFindAtomW GetSystemTime LocalUnlock LocalLock GlobalGetAtomNameW GetAtomNameW SuspendThread ResumeThread SetEvent CopyFileW WaitForMultipleObjects CreateEventW ReleaseMutex CreateMutexW ReleaseSemaphore CreateSemaphoreW WaitForSingleObject FormatMessageW SetFileAttributesW LocalFileTimeToFileTime GetFileAttributesExW GetFileSizeEx FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime FileTimeToSystemTime GetShortPathNameW GetStringTypeExW GetThreadLocale FindClose FindFirstFileW GetVolumeInformationW MoveFileW SetEndOfFile UnlockFile LockFile FlushFileBuffers WriteFile ReadFile GetCurrentProcess DuplicateHandle GetProfileIntW SystemTimeToFileTime ReplaceFileW SetFileTime GetFileTime GetFullPathNameW GetDiskFreeSpaceW GetTempFileNameW VirtualProtect RaiseException lstrcpyA CompareStringW GetCurrentThread GetVersionExW WideCharToMultiByte lstrcmpA CompareStringA GlobalDeleteAtom SetErrorMode GetCurrentProcessId GlobalAddAtomW IsDBCSLeadByte GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW FindResourceExW GetUserDefaultLCID SizeofResource

vcruntime140

_except_handler4_common memcmp wcsrchr wcsstr wcschr _purecall memmove memset memcpy __std_terminate __CxxFrameHandler3 __std_type_info_destroy_list _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _initterm_e _initterm _endthreadex abort _invalid_parameter_noinfo _errno terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll __doserrno _endthread _beginthread _resetstkoflw __p___wargv __p___argc

api-ms-win-crt-string-l1-1-0

iswspace wcscmp wmemcpy_s wcsnlen _wcsicmp wcspbrk wcscspn wcsncpy_s toupper _wcslwr_s wcslen strcpy_s _strnicmp _wcsupr_s _wcsrev wcscoll _wcsicoll wcsncmp wcscpy_s iswdigit iswalpha iswalnum iswprint towupper towlower _wcsnicmp wcsspn wcscat_s strnlen _wcsdup strlen

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle _fileno _open_osfhandle __stdio_common_vsprintf_s clearerr_s fread fclose fflush feof ferror __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vswscanf fwrite __stdio_common_vswprintf_s __stdio_common_vswprintf fputws ftell fseek fgetws

api-ms-win-crt-utility-l1-1-0

labs abs rand_s ldiv

api-ms-win-crt-heap-l1-1-0

_msize malloc _expand realloc _recalloc calloc free

api-ms-win-crt-convert-l1-1-0

_itow_s wcstod wcstoul wcstol _wtol _ltow_s _ultow_s _wtoi

api-ms-win-crt-math-l1-1-0

_fdopen exp ceil sqrt atan2 cos sin floor fabs

api-ms-win-crt-time-l1-1-0

_mktime64 clock _localtime64_s _time64

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _wsplitpath_s _wfullpath

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp _mbsrchr _mbsstr _mbscspn _mbscoll _mbsinc _mbsspn _mbscmp _mbsrev _mbsicoll _mbslwr_s _mbspbrk _mbsupr_s _ismbcspace _mbschr

user32

TranslateAcceleratorW GetSystemMetrics DestroyMenu LoadMenuW GetSubMenu PostThreadMessageW GetClassInfoW DefWindowProcW GetWindow GetMenuItemCount GetMenuItemID IsIconic GetCursorPos DrawIcon GetMonitorInfoW MonitorFromPoint SystemParametersInfoW ValidateRect SetLayeredWindowAttributes CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx GetUpdateRect UnionRect SetWindowPos LockWindowUpdate GetKeyState BeginDeferWindowPos EndDeferWindowPos AppendMenuW CreatePopupMenu IntersectRect SetScrollPos EnableMenuItem GetNextDlgTabItem GetSystemMenu IsMenu IsZoomed ModifyMenuW DeleteMenu SetWindowRgn DestroyAcceleratorTable GetTopWindow DestroyWindow MonitorFromRect EnumDisplayMonitors GetSysColor GetClassLongW IsClipboardFormatAvailable DestroyCursor CreateAcceleratorTableW CopyAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyW CharUpperW SetWindowTextW GetMenuState CheckMenuItem SetFocus GetMenuItemInfoW DrawFrameControl SubtractRect GetLastActivePopup GetMessageW UpdateLayeredWindow EnableScrollBar GetScrollPos GetMenuDefaultItem SetMenuDefaultItem HideCaret InvertRect EnumChildWindows GetWindowTextW GetDoubleClickTime GetDC ReleaseDC GetWindowRgn FrameRect ShowScrollBar IsWindowEnabled InsertMenuW GetActiveWindow RegisterClipboardFormatW GetComboBoxInfo CharUpperBuffW DrawEdge PostQuitMessage UnregisterClassW ShowOwnedPopups LoadAcceleratorsW MessageBoxW SetWindowLongW SetMenuItemBitmaps SetMenuItemInfoW GetMenuCheckMarkDimensions CallWindowProcW SetActiveWindow CreateMenu MoveWindow InvalidateRgn TabbedTextOutW DrawTextW DrawTextExW GrayStringW GetWindowTextLengthW GetTabbedTextExtentW GetDlgItem CreateDialogIndirectParamW EndDialog GetPropW RemovePropW SetPropW MapDialogRect GetMessageTime GetMessagePos GetDialogBaseUnits GetDCEx RemoveMenu MsgWaitForMultipleObjectsEx CharNextW SetWindowContextHelpId IsDialogMessageW ClipCursor SendNotifyMessageW InSendMessage GetMenuStringW WindowFromDC SetScrollRange AdjustWindowRectEx CountClipboardFormats GetMenu SetMenu GetClassInfoExW CreateWindowExW SetWindowPlacement TrackPopupMenuEx RegisterClassW WinHelpW GetScrollRange SetScrollInfo GetScrollInfo ScrollWindow MonitorFromWindow BeginPaint EndPaint SendDlgItemMessageA UnpackDDElParam ReuseDDElParam InsertMenuItemW GetMenuBarInfo GetWindowDC DefFrameProcW TranslateMDISysAccel DrawMenuBar DefMDIChildProcW CheckDlgButton CheckRadioButton GetDlgItemInt GetDlgItemTextW SendDlgItemMessageW SetDlgItemInt SetDlgItemTextW IsDlgButtonChecked ScrollWindowEx RealChildWindowFromPoint CharToOemBuffA OemToCharBuffA IsWindowVisible GetClientRect KillTimer SetRectEmpty GetWindowRect InvalidateRect RedrawWindow IsWindow SetRect EnableWindow IsCharLowerW GetKeyNameTextW GetKeyboardLayout MapVirtualKeyExW GetCapture DrawStateW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetAsyncKeyState GetDesktopWindow WaitMessage DispatchMessageW TranslateMessage PeekMessageW SetForegroundWindow LoadCursorW GetFocus IsChild TrackPopupMenu LoadIconW GetNextDlgGroupItem DrawFocusRect SetCursor GetWindowLongW LoadImageW CopyImage GetIconInfo FillRect NotifyWinEvent CopyRect LoadBitmapW MapWindowPoints MessageBeep SetCursorPos WindowFromPoint ClientToScreen SetCapture ReleaseCapture CopyIcon BringWindowToTop RegisterWindowMessageW DestroyIcon GetClassNameW SetParent ShowWindow GetWindowPlacement IsRectEmpty GetDlgCtrlID PostMessageW DeferWindowPos EqualRect GetSysColorBrush SetClassLongW GetParent DrawIconEx InflateRect OffsetRect PtInRect UpdateWindow SetTimer TrackMouseEvent GetWindowThreadProcessId ScreenToClient GetForegroundWindow SendMessageW

gdi32

PtVisible GetViewportOrgEx DeleteMetaFile CloseMetaFile CreateMetaFileW LPtoDP GetCharWidthW CreateFontW StretchDIBits RoundRect CreateEllipticRgn CreateHatchBrush ExtTextOutW Polyline SetDIBColorTable GetDIBits SelectPalette StretchBlt SetBkColor CreateBitmap EnumFontFamiliesExW CreateRoundRectRgn SetRectRgn FillRgn GetBoundsRect CombineRgn CreateRectRgn PatBlt DeleteDC GetCurrentObject EndDoc EndPage StartPage ExtFloodFill SetPaletteEntries CreateDIBitmap CreatePatternBrush CreatePen EnumFontFamiliesW GetTextCharsetInfo GetDeviceCaps CreateFontIndirectW GetBkColor SetPixel Ellipse CreateDIBSection OffsetRgn CreateRectRgnIndirect GetRgnBox BitBlt SetPixelV CreateCompatibleBitmap FrameRgn PtInRegion CreatePolygonRgn GetPixel GetSystemPaletteEntries GetNearestPaletteIndex RealizePalette CreatePalette GetPaletteEntries GetStockObject TextOutW Polygon GetTextColor GetObjectType DeleteObject SelectObject CreateCompatibleDC GetObjectW CreateSolidBrush GetTextExtentPoint32W GetTextMetricsW GetClipBox Escape GetTextAlign GetCurrentPositionEx MoveToEx SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SaveDC RestoreDC GetROP2 GetBkMode GetPolyFillMode GetStretchBltMode GetNearestColor GetTextFaceW GetWindowExtEx GetViewportExtEx SetTextColor SetMapMode SetWindowExtEx ScaleWindowExtEx GetWindowOrgEx SetWindowOrgEx IntersectClipRect CreateDCW SetBrushOrgEx SetAbortProc StartDocW DPtoLP AbortDoc CopyMetaFileW UnrealizeObject SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetGraphicsMode SetWorldTransform ModifyWorldTransform OffsetWindowOrgEx SelectClipRgn ExcludeClipRect OffsetClipRgn LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetLayout SetLayout ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo SelectClipPath GetClipRgn ExtSelectClipRgn PlayMetaFileRecord PlayMetaFile EnumMetaFile ExtCreatePen CreateDIBPatternBrushPt GetMapMode RectVisible Rectangle

ole32

OleLockRunning CoTaskMemFree OleSetContainedObject CoCreateInstance OleDraw OleRegGetMiscStatus StgOpenStorageOnILockBytes CLSIDFromString OleRegEnumVerbs CoDisconnectObject CoRegisterMessageFilter CoTreatAsClass CoCreateGuid SetConvertStg WriteFmtUserTypeStg OleDuplicateData WriteClassStg GetRunningObjectTable OleTranslateAccelerator IsAccelerator PropVariantClear CoFreeUnusedLibraries CoInitialize CoRevokeClassObject CoRegisterClassObject RevokeDragDrop CLSIDFromProgID RegisterDragDrop CoLockObjectExternal DoDragDrop CoUninitialize CoGetMalloc StgOpenStorage StgIsStorageFile StgCreateDocfile OleIsCurrentClipboard OleSetClipboard OleGetClipboard OleRegGetUserType GetClassFile CreateBindCtx CreateFileMoniker OleRun StringFromCLSID OleUninitialize OleIsRunning OleQueryLinkFromData OleQueryCreateFromData OleSetMenuDescriptor CreateGenericComposite CreateItemMoniker WriteClassStm OleGetIconOfClass GetHGlobalFromILockBytes ReadClassStg OleLoad OleSave PropVariantCopy CoInitializeEx CoGetClassObject StringFromGUID2 ReadFmtUserTypeStg OleLoadFromStream StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal ReadClassStm OleSaveToStream CreateOleAdviseHolder OleDestroyMenuDescriptor OleCreateMenuDescriptor ReleaseStgMedium CreateDataAdviseHolder CreateDataCache OleCreate OleCreateLinkToFile OleCreateFromFile CoTaskMemAlloc CreateStreamOnHGlobal OleCreateStaticFromData OleCreateLinkFromData OleCreateFromData OleInitialize OleFlushClipboard

oleaut32

SysAllocStringLen SysAllocString SysStringLen SysFreeString VariantChangeType VariantClear VariantTimeToSystemTime SystemTimeToVariantTime VarParseNumFromStr SafeArrayCreateVector VarBstrFromDec VarDecFromStr VarDateFromStr SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SafeArrayAllocData SafeArrayCopy VarBstrFromCy VarCyFromStr SysReAllocStringLen SysAllocStringByteLen SafeArrayRedim SafeArrayCreate SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayGetDim SysStringByteLen SafeArrayDestroy VariantCopy VarBstrCmp DispCallFunc VariantInit LoadRegTypeLi RegisterTypeLi LoadTypeLi OleLoadPicture OleCreatePictureIndirect OleCreateFontIndirect OleTranslateColor OleCreatePropertyFrame VarBstrFromDate

shlwapi

StrFormatKBSizeW PathFindExtensionW PathFindFileNameW PathRemoveExtensionW PathRemoveFileSpecW PathIsUNCW PathStripToRootW UrlUnescapeW

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

uxtheme

DrawThemeParentBackground GetWindowTheme DrawThemeBackground GetThemeColor OpenThemeData CloseThemeData GetCurrentThemeName GetThemeSysColor DrawThemeText IsThemeBackgroundPartiallyTransparent GetThemePartSize IsAppThemed

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/msvcp140.dll

IMPHASH b762273fad87a3ab566b1559c5b77d45
SHA256 038a419c6225eda86802dd2bfbc636cc4f7d175c64937f51acded8f1785e8a12
MD5 fcdc4950a9f9bc8da12eae2b1cfd582a
SHA1 ab4fc2d8154b8b141f61711e3be1fbab379e13f3
SHA512 8949df41cd37ae67e421375fa8c74c0fcf92da39d1a5f8ee52de55e0b05982afd4a73d8e9ac6d2b5f06245fb3ded985a41fc7a7406cff147ad4575753cf357d9
SSDEEP 12288:CnIPHMVwD9dq5/iNJ6PJ0F5HCrdhUgiW6QR7t5s03Ooc8dHkC2eseG1:CnIPHMVwD0iNJy0FdN03Ooc8dHkC2e/K
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

5a:b7:57:be:7e:c9:ee:0b:d5:f5:60:22:08:b1:18:8c:c9:ad:4c:36:04:3e:34:aa:1e:ec:53:36:91:06:e9:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

250640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb

vcruntime140

_except_handler4_common __uncaught_exceptions __uncaught_exception memmove __std_terminate _purecall __CxxFrameHandler3 _CxxThrowException __AdjustPointer __processing_throw __current_exception __std_exception_destroy __std_exception_copy memset memcmp memchr __std_type_info_destroy_list memcpy

api-ms-win-crt-locale-l1-1-0

__pctype_func ___lc_locale_name_func localeconv setlocale _unlock_locales ___lc_collate_cp_func ___mb_cur_max_func ___lc_codepage_func _lock_locales

api-ms-win-crt-string-l1-1-0

wcsnlen wcscpy_s isupper iswctype __strncnt tolower isalnum isxdigit isspace islower isdigit strcspn _wcsdup

api-ms-win-crt-heap-l1-1-0

malloc calloc realloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_endthreadex _initterm_e _initterm _errno _invalid_parameter_noinfo_noreturn abort _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _cexit _crt_atexit _execute_onexit_table _register_onexit_function _set_new_handler _initialize_onexit_table _beginthreadex terminate

api-ms-win-crt-math-l1-1-0

frexp _CIlog _CIpow ldexp

api-ms-win-crt-convert-l1-1-0

strtod btowc strtof

api-ms-win-crt-stdio-l1-1-0

_fsopen fseek fputs ungetc setvbuf fwrite _fseeki64 fsetpos _wfsopen fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vsprintf_s fread ungetwc fputwc fgetwc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wrename _unlock_file _wchdir _wrmdir _wremove

api-ms-win-crt-time-l1-1-0

_Strftime _Gettnames _Getmonths _Wcsftime _W_Getdays _Getdays _W_Gettnames _W_Getmonths

api-ms-win-crt-environment-l1-1-0

_wgetcwd

api-ms-win-crt-utility-l1-1-0

rand_s

kernel32

QueueUserWorkItem WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW MultiByteToWideChar EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WideCharToMultiByte EncodePointer DecodePointer RaiseException LoadLibraryExA FreeLibrary VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead GetCurrentProcessId IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetProcAddress GetModuleHandleW GetTickCount GetSystemTimeAsFileTime CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetModuleHandleExW CloseHandle IsProcessorFeaturePresent RtlCaptureStackBackTrace TryEnterCriticalSection FormatMessageW CreateHardLinkW CopyFileW GetLastError AreFileApisANSI GetTempPathW SetFileTime SetFilePointerEx SetFileAttributesW SetEndOfFile GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindClose CreateFileW CreateDirectoryW GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo

??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z ??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z ??0?$_Yarn@D@std@@QAE@ABV01@@Z ??0?$_Yarn@D@std@@QAE@PBD@Z ??0?$_Yarn@D@std@@QAE@XZ ??0?$_Yarn@G@std@@QAE@ABV01@@Z ??0?$_Yarn@G@std@@QAE@PBG@Z ??0?$_Yarn@G@std@@QAE@XZ ??0?$_Yarn@_W@std@@QAE@ABV01@@Z ??0?$_Yarn@_W@std@@QAE@PB_W@Z ??0?$_Yarn@_W@std@@QAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ ??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@ABV01@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@ABV01@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@ABV01@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@W4_Uninitialized@1@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$codecvt@DDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@DDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z ??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z ??0?$ctype@D@std@@QAE@PBF_NI@Z ??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z ??0?$ctype@G@std@@QAE@I@Z ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z ??0?$ctype@_W@std@@QAE@I@Z ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0Init@ios_base@std@@QAE@XZ ??0_Facet_base@std@@QAE@ABV01@@Z ??0_Facet_base@std@@QAE@XZ ??0_Init_locks@std@@QAE@XZ ??0_Locimp@locale@std@@AAE@ABV012@@Z ??0_Locimp@locale@std@@AAE@_N@Z ??0_Locinfo@std@@QAE@HPBD@Z ??0_Locinfo@std@@QAE@PBD@Z ??0_Lockit@std@@QAE@H@Z ??0_Lockit@std@@QAE@XZ ??0_Timevec@std@@QAE@ABV01@@Z ??0_Timevec@std@@QAE@PAX@Z ??0_UShinit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??0codecvt_base@std@@QAE@I@Z ??0ctype_base@std@@QAE@I@Z ??0facet@locale@std@@IAE@I@Z ??0id@locale@std@@QAE@I@Z ??0ios_base@std@@IAE@XZ ??0task_continuation_context@Concurrency@@AAE@XZ ??0time_base@std@@QAE@I@Z ??1?$_Yarn@D@std@@QAE@XZ ??1?$_Yarn@G@std@@QAE@XZ ??1?$_Yarn@_W@std@@QAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$codecvt@DDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@_SDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@_UDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ ??1?$ctype@D@std@@MAE@XZ ??1?$ctype@G@std@@MAE@XZ ??1?$ctype@_W@std@@MAE@XZ ??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1Init@ios_base@std@@QAE@XZ ??1_Facet_base@std@@UAE@XZ ??1_Init_locks@std@@QAE@XZ ??1_Locimp@locale@std@@MAE@XZ ??1_Locinfo@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??1_Timevec@std@@QAE@XZ ??1_UShinit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1codecvt_base@std@@UAE@XZ ??1ctype_base@std@@UAE@XZ ??1facet@locale@std@@MAE@XZ ??1ios_base@std@@UAE@XZ ??1time_base@std@@UAE@XZ ??4?$_Iosb@H@std@@QAEAAV01@$$QAV01@@Z ??4?$_Iosb@H@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@D@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ??4?$_Yarn@G@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@G@std@@QAEAAV01@PBG@Z ??4?$_Yarn@_W@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z ??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_istream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_istream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEAAV01@ABV01@@Z ??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEAAV01@ABV01@@Z ??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEAAV01@ABV01@@Z ??4Init@ios_base@std@@QAEAAV012@ABV012@@Z ??4_Crt_new_delete@std@@QAEAAU01@$$QAU01@@Z ??4_Crt_new_delete@std@@QAEAAU01@ABU01@@Z ??4_Facet_base@std@@QAEAAV01@ABV01@@Z ??4_Init_locks@std@@QAEAAV01@ABV01@@Z ??4_Timevec@std@@QAEAAV01@ABV01@@Z ??4_UShinit@std@@QAEAAV01@ABV01@@Z ??4_Winit@std@@QAEAAV01@ABV01@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAJ@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAO@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAJ@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAN@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAO@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAPAX@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z ??7ios_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ??Bios_base@std@@QBE_NXZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$codecvt@DDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@GDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_SDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_UDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ ??_7?$ctype@D@std@@6B@ ??_7?$ctype@G@std@@6B@ ??_7?$ctype@_W@std@@6B@ ??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ ??_7_Locimp@locale@std@@6B@ ??_7codecvt_base@std@@6B@ ??_7ctype_base@std@@6B@ ??_7facet@locale@std@@6B@ ??_7ios_base@std@@6B@ ??_7time_base@std@@6B@ ??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@ ??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@ ??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@ ??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@ ??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@ ??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@ ??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@ ??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@ ??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@ ??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@ ??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEXXZ ??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ ??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_F?$codecvt@DDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@GDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@_SDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@_UDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@_WDU_Mbstatet@@@std@@QAEXXZ ??_F?$ctype@D@std@@QAEXXZ ??_F?$ctype@G@std@@QAEXXZ ??_F?$ctype@_W@std@@QAEXXZ ??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F_Locinfo@std@@QAEXXZ ??_F_Timevec@std@@QAEXXZ ??_Fcodecvt_base@std@@QAEXXZ ??_Fctype_base@std@@QAEXXZ ??_Ffacet@locale@std@@QAEXXZ ??_Fid@locale@std@@QAEXXZ ??_Ftime_base@std@@QAEXXZ ?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?GetNextAsyncId@platform@details@Concurrency@@YAIXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ ?_Addcats@_Locinfo@std@@QAEAAV12@HPBD@Z ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z ?_Addstd@ios_base@std@@SAXPAV12@@Z ?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z ?_Atexit@@YAXP6AXXZ@Z ?_BADOFF@std@@3_JB ?_C_str@?$_Yarn@D@std@@QBEPBDXZ ?_C_str@?$_Yarn@G@std@@QBEPBGXZ ?_C_str@?$_Yarn@_W@std@@QBEPB_WXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z ?_Callfns@ios_base@std@@AAEXW4event@12@@Z ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ ?_Clocptr@_Locimp@locale@std@@0PAV123@A ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Donarrow@?$ctype@G@std@@IBEDGD@Z ?_Donarrow@?$ctype@_W@std@@IBED_WD@Z ?_Dowiden@?$ctype@G@std@@IBEGD@Z ?_Dowiden@?$ctype@_W@std@@IBE_WD@Z ?_Empty@?$_Yarn@D@std@@QBE_NXZ ?_Empty@?$_Yarn@G@std@@QBE_NXZ ?_Empty@?$_Yarn@_W@std@@QBE_NXZ ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADDH@Z ?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADDH@Z ?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z ?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z ?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z ?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@_SDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@_UDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getdateorder@_Locinfo@std@@QBEHXZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getfalse@_Locinfo@std@@QBEPBDXZ ?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z ?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z ?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z ?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z ?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z ?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z ?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z ?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z ?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z ?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z ?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z ?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAAHABV?$ctype@G@2@@Z ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z ?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_Getname@_Locinfo@std@@QBEPBDXZ ?_Getptr@_Timevec@std@@QBEPAXXZ ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ ?_Gettrue@_Locinfo@std@@QBEPBDXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ ?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Id_cnt@id@locale@std@@0HA ?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADPBDH@Z ?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADPBDH@Z ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z ?_Incref@facet@locale@std@@UAEXXZ ?_Index@ios_base@std@@0HA ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAPAG0PAH001@Z ?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPAPA_W0PAH001@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?_Init@?$codecvt@DDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@GDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@_SDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@_UDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@_WDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$ctype@G@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$ctype@_W@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@ios_base@std@@IAEXXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Init_cnt@Init@ios_base@std@@0HA ?_Init_cnt@_UShinit@std@@0HA ?_Init_cnt@_Winit@std@@0HA ?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ ?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z ?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z ?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z ?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z ?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z ?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ ?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z ?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z ?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z ?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z ?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z ?_Lockit_ctor@_Lockit@std@@SAXH@Z ?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z ?_Lockit_dtor@_Lockit@std@@SAXH@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_MP_Add@std@@YAXQA_K_K@Z ?_MP_Get@std@@YA_KQA_K@Z ?_MP_Mul@std@@YAXQA_K_K1@Z ?_MP_Rem@std@@YAXQA_K_K@Z ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z ?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z ?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z ?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z ?_Mtx_delete@threads@stdext@@YAXPAX@Z ?_Mtx_lock@threads@stdext@@YAXPAX@Z ?_Mtx_new@threads@stdext@@YAXAAPAX@Z ?_Mtx_unlock@threads@stdext@@YAXPAX@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ ?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Ptr_cerr@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ptr_cin@std@@3PAV?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Ptr_clog@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ptr_cout@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ptr_wcerr@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A ?_Ptr_wcerr@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Ptr_wcin@std@@3PAV?$basic_istream@GU?$char_traits@G@std@@@1@A ?_Ptr_wcin@std@@3PAV?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?_Ptr_wclog@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A ?_Ptr_wclog@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A ?_Ptr_wcout@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z ?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBGI@Z ?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA ?_Random_device@std@@YAIXZ ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z ?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@GI@Z ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reschedule_chore@details@Concurrency@@YAHPBU_Threadpool_chore@12@@Z ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Rng_abort@std@@YAXPBD@Z ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z ?_Setgloballocale@locale@std@@CAXPAX@Z ?_Src@?1??_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1HABVlocale@3@@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1HABVlocale@3@@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1HABVlocale@3@@Z@4QBDB ?_Sync@ios_base@std@@0_NA ?_Syserror_map@std@@YAPBDH@Z ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?_Tidy@?$_Yarn@D@std@@AAEXXZ ?_Tidy@?$_Yarn@G@std@@AAEXXZ ?_Tidy@?$_Yarn@_W@std@@AAEXXZ ?_Tidy@?$ctype@D@std@@IAEXXZ ?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AAEXXZ ?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AAEXXZ ?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AAEXXZ ?_Tidy@ios_base@std@@AAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ ?_Winerror_map@std@@YAHH@Z ?_Winerror_message@std@@YAKKPADK@Z ?_XGetLastError@std@@YAXXZ ?_XLgamma@std@@YAMM@Z ?_XLgamma@std@@YANN@Z ?_XLgamma@std@@YAOO@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xoverflow_error@std@@YAXPBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xruntime_error@std@@YAXPBD@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrCompare@@YA_NPBX0@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrSwap@@YAXPAX0@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?bad@ios_base@std@@QBE_NXZ ?c_str@?$_Yarn@D@std@@QBEPBDXZ ?c_str@?$_Yarn@G@std@@QBEPBGXZ ?c_str@?$_Yarn@_W@std@@QBEPB_WXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?classic@locale@std@@SAABV12@XZ ?classic_table@?$ctype@D@std@@SAPBFXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z ?clear@ios_base@std@@QAEXH@Z ?clear@ios_base@std@@QAEXH_N@Z ?clear@ios_base@std@@QAEXI@Z ?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z ?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEAAV12@ABV12@@Z ?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEAAV12@ABV12@@Z ?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ ?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ ?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ ?do_always_noconv@?$codecvt@DDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@_SDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@_UDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@codecvt_base@std@@MBE_NXZ ?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ ?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ ?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ ?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@codecvt_base@std@@MBEHXZ ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?do_get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?do_get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?do_get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_in@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z ?do_in@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z ?do_in@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z ?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z ?do_is@?$ctype@G@std@@MBE_NFG@Z ?do_is@?$ctype@_W@std@@MBEPB_WPB_W0PAF@Z ?do_is@?$ctype@_W@std@@MBE_NF_W@Z ?do_length@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@codecvt_base@std@@MBEHXZ ?do_narrow@?$ctype@D@std@@MBEDDD@Z ?do_narrow@?$ctype@D@std@@MBEPBDPBD0DPAD@Z ?do_narrow@?$ctype@G@std@@MBEDGD@Z ?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z ?do_narrow@?$ctype@_W@std@@MBED_WD@Z ?do_narrow@?$ctype@_W@std@@MBEPB_WPB_W0DPAD@Z ?do_out@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z ?do_out@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z ?do_out@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z ?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z ?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z ?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z ?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z ?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z ?do_scan_is@?$ctype@_W@std@@MBEPB_WFPB_W0@Z ?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z ?do_scan_not@?$ctype@_W@std@@MBEPB_WFPB_W0@Z ?do_tolower@?$ctype@D@std@@MBEDD@Z ?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z ?do_tolower@?$ctype@G@std@@MBEGG@Z ?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z ?do_tolower@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z ?do_tolower@?$ctype@_W@std@@MBE_W_W@Z ?do_toupper@?$ctype@D@std@@MBEDD@Z ?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z ?do_toupper@?$ctype@G@std@@MBEGG@Z ?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z ?do_toupper@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z ?do_toupper@?$ctype@_W@std@@MBE_W_W@Z ?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_widen@?$ctype@D@std@@MBEDD@Z ?do_widen@?$ctype@D@std@@MBEPBDPBD0PAD@Z ?do_widen@?$ctype@G@std@@MBEGD@Z ?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z ?do_widen@?$ctype@_W@std@@MBEPBDPBD0PA_W@Z ?do_widen@?$ctype@_W@std@@MBE_WD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?empty@?$_Yarn@D@std@@QBE_NXZ ?empty@?$_Yarn@G@std@@QBE_NXZ ?empty@?$_Yarn@_W@std@@QBE_NXZ ?empty@locale@std@@SA?AV12@XZ ?encoding@codecvt_base@std@@QBEHXZ ?eof@ios_base@std@@QBE_NXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?exceptions@ios_base@std@@QAEXH@Z ?exceptions@ios_base@std@@QAEXI@Z ?exceptions@ios_base@std@@QBEHXZ ?fail@ios_base@std@@QBE_NXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEGG@Z ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ?flags@ios_base@std@@QAEHH@Z ?flags@ios_base@std@@QBEHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ ?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QBE_JXZ ?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QBE_JXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAG@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AA_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z ?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBG4@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PB_W4@Z ?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_new_handler@std@@YAP6AXXZXZ ?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?global@locale@std@@SA?AV12@ABV12@@Z ?good@ios_base@std@@QBE_NXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$collate@G@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$ctype@G@std@@2V0locale@2@A ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$messages@D@std@@2V0locale@2@A ?id@?$messages@G@std@@2V0locale@2@A ?id@?$messages@_W@std@@2V0locale@2@A ?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$moneypunct@D$00@std@@2V0locale@2@A ?id@?$moneypunct@D$0A@@std@@2V0locale@2@A ?id@?$moneypunct@G$00@std@@2V0locale@2@A ?id@?$moneypunct@G$0A@@std@@2V0locale@2@A ?id@?$moneypunct@_W$00@std@@2V0locale@2@A ?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A ?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$numpunct@G@std@@2V0locale@2@A ?id@?$numpunct@_W@std@@2V0locale@2@A ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JG@Z ?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JG@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z ?in@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z ?in@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ ?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JXZ ?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z ?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z ?intl@?$moneypunct@D$00@std@@2_NB ?intl@?$moneypunct@D$0A@@std@@2_NB ?intl@?$moneypunct@G$00@std@@2_NB ?intl@?$moneypunct@G$0A@@std@@2_NB ?intl@?$moneypunct@_W$00@std@@2_NB ?intl@?$moneypunct@_W$0A@@std@@2_NB ?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z ?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z ?is@?$ctype@D@std@@QBEPBDPBD0PAF@Z ?is@?$ctype@D@std@@QBE_NFD@Z ?is@?$ctype@G@std@@QBEPBGPBG0PAF@Z ?is@?$ctype@G@std@@QBE_NFG@Z ?is@?$ctype@_W@std@@QBEPB_WPB_W0PAF@Z ?is@?$ctype@_W@std@@QBE_NF_W@Z ?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ ?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?iword@ios_base@std@@QAEAAJH@Z ?length@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?max_length@codecvt_base@std@@QBEHXZ ?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEX$$QAV12@@Z ?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z ?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEX$$QAV12@@Z ?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z ?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEX$$QAV12@@Z ?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z ?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z ?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEDGD@Z ?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBED_WD@Z ?narrow@?$ctype@D@std@@QBEDDD@Z ?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z ?narrow@?$ctype@G@std@@QBEDGD@Z ?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z ?narrow@?$ctype@_W@std@@QBED_WD@Z ?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z ?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ ?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ ?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE_NXZ ?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z ?out@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z ?out@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z ?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z ?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ ?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?precision@ios_base@std@@QAE_J_J@Z ?precision@ios_base@std@@QBE_JXZ ?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PAD_J@Z ?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAG_J@Z ?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PA_W_J@Z ?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ ?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z ?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z ?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@PBG3@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z ?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?pword@ios_base@std@@QAEAAPAXH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAV32@@Z ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PAV32@@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?rdstate@ios_base@std@@QBEHXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z ?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z ?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z ?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z ?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z ?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z ?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?scan_is@?$ctype@D@std@@QBEPBDFPBD0@Z ?scan_is@?$ctype@G@std@@QBEPBGFPBG0@Z ?scan_is@?$ctype@_W@std@@QBEPB_WFPB_W0@Z ?scan_not@?$ctype@D@std@@QBEPBDFPBD0@Z ?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z ?scan_not@?$ctype@_W@std@@QBEPB_WFPB_W0@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z ?set_rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z ?set_rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z ?setbase@std@@YA?AU?$_Smanip@H@1@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?setf@ios_base@std@@QAEHH@Z ?setf@ios_base@std@@QAEHHH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z ?setstate@ios_base@std@@QAEXH@Z ?setstate@ios_base@std@@QAEXH_N@Z ?setstate@ios_base@std@@QAEXI@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z ?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z ?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z ?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ ?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z ?swap@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z ?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z ?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_istream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@ios_base@std@@QAEXAAV12@@Z ?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ ?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?table@?$ctype@D@std@@QBEPBFXZ ?table_size@?$ctype@D@std@@2IB ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@PAV32@@Z ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PAV32@@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?tolower@?$ctype@D@std@@QBEDD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?tolower@?$ctype@G@std@@QBEGG@Z ?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ?toupper@?$ctype@D@std@@QBEDD@Z ?toupper@?$ctype@D@std@@QBEPBDPADPBD@Z ?toupper@?$ctype@G@std@@QBEGG@Z ?toupper@?$ctype@G@std@@QBEPBGPAGPBG@Z ?toupper@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?toupper@?$ctype@_W@std@@QBE_W_W@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?uncaught_exception@std@@YA_NXZ ?uncaught_exceptions@std@@YAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ ?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?unsetf@ios_base@std@@QAEXH@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ?widen@?$ctype@D@std@@QBEDD@Z ?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z ?widen@?$ctype@G@std@@QBEGD@Z ?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z ?widen@?$ctype@_W@std@@QBEPBDPBD0PA_W@Z ?widen@?$ctype@_W@std@@QBE_WD@Z ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBG_J@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z ?xalloc@ios_base@std@@SAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z _Chmod _Close_dir _Cnd_broadcast _Cnd_destroy _Cnd_destroy_in_situ _Cnd_do_broadcast_at_thread_exit _Cnd_init _Cnd_init_in_situ _Cnd_register_at_thread_exit _Cnd_signal _Cnd_timedwait _Cnd_unregister_at_thread_exit _Cnd_wait _Copy_file _Cosh _Current_get _Current_set _Denorm _Dtest _Equivalent _Exp _FCosh _FDenorm _FDtest _FExp _FInf _FNan _FSinh _FSnan _File_size _Getcoll _Getctype _Getcvt _Getdateorder _Getwctype _Getwctypes _Hard_links _Hugeval _Inf _LCosh _LDenorm _LDtest _LExp _LInf _LNan _LSinh _LSnan _Last_write_time _Link _Lock_shared_ptr_spin_lock _Lstat _Make_dir _Mbrtowc _Mtx_clear_owner _Mtx_current_owns _Mtx_destroy _Mtx_destroy_in_situ _Mtx_getconcrtcs _Mtx_init _Mtx_init_in_situ _Mtx_lock _Mtx_reset_owner _Mtx_timedlock _Mtx_trylock _Mtx_unlock _Mtxdst _Mtxinit _Mtxlock _Mtxunlock _Nan _Open_dir _Query_perf_counter _Query_perf_frequency _Read_dir _Remove_dir _Rename _Resize _Set_last_write_time _Sinh _Snan _Stat _Statvfs _Stod _Stodx _Stof _Stofx _Stold _Stoldx _Stoll _Stollx _Stolx _Stoul _Stoull _Stoullx _Stoulx _Strcoll _Strxfrm _Symlink _Symlink_get _Temp_get _Thrd_abort _Thrd_create _Thrd_current _Thrd_detach _Thrd_equal _Thrd_exit _Thrd_hardware_concurrency _Thrd_id _Thrd_join _Thrd_sleep _Thrd_start _Thrd_yield _To_byte _To_wide _Tolower _Toupper _Towlower _Towupper _Unlink _Unlock_shared_ptr_spin_lock _WStod _WStodx _WStof _WStofx _WStold _WStoldx _Wcrtomb _Wcscoll _Wcsxfrm _Xtime_diff_to_millis _Xtime_diff_to_millis2 _Xtime_get_ticks __Wcrtomb_lk __crtCloseThreadpoolTimer __crtCloseThreadpoolWait __crtCompareStringA __crtCompareStringEx __crtCompareStringW __crtCreateEventExW __crtCreateSemaphoreExW __crtCreateSymbolicLinkW __crtCreateThreadpoolTimer __crtCreateThreadpoolWait __crtFlushProcessWriteBuffers __crtFreeLibraryWhenCallbackReturns __crtGetCurrentProcessorNumber __crtGetFileInformationByHandleEx __crtGetLocaleInfoEx __crtGetSystemTimePreciseAsFileTime __crtGetTickCount64 __crtInitOnceExecuteOnce __crtInitializeCriticalSectionEx __crtIsPackagedApp __crtLCMapStringA __crtLCMapStringEx __crtLCMapStringW __crtSetFileInformationByHandle __crtSetThreadpoolTimer __crtSetThreadpoolWait __crtWaitForThreadpoolTimerCallbacks __set_stl_sync_api_mode xtime_get

Name

.text

Size

391KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/vcruntime140.dll

IMPHASH 6a84b7445ccacd5d29ac27de2745f356
SHA256 ee2d1077b36102794673334095fc60262cb03d7f66a42a3e9c93804338276987
MD5 711b62e03fa4749550f538a5c6ff97d7
SHA1 e67833c3642e41acd6aae9890444b5a0ad9688f9
SHA512 2ae853dc5cd708281a732610789d63d3c324a028b9ab57089ff2216692b7c69caa1068daf660bcec30f1feae394fae814619948954baf8d5c8692e5788cbe622
SSDEEP 1536:usK8Oxv5v9RslezBDbbqVoZ9Sh1gfobWBecbYbU00:usK5v9Gl6tbb6oKhCtecbYbP0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

55:18:05:a3:44:33:57:19:8a:03:89:ab:85:27:85:a0:3e:58:1e:9a:eb:61:89:65:d8:85:44:a1:c7:1e:9f:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

6

Entry point

55488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/win32/win10RS6/amselam.sys

IMPHASH 4a4c289374fe02e199c10129642c2c9e
SHA256 9d2479cfe101d6734b01f053398e3ba17154d456c774d8bc619c544831895052
MD5 b3844014d965c15f8b6b8c3a8cf1e7ec
SHA1 c1a7f8f550c2365f57e6f80b01d91b201fdef30d
SHA512 8e7262bff3cde9fa8632efef4bee3534c8965d71be58747ddda7e4b7607b4d5a329db9c3c8bfb25764f028462dc16314aad5804c4923e27df0c7e5286aa2bac0
SSDEEP 192:xjM9t+HnCCUHFrw4372weX5wwyMAx6um6JonC7fo8k9CUqoOWiVdDIVWQ4PGWIQ3:2SHdUHNsXb6Joo+9Fq0/oK6ldCE
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e3:00:ef:2c:a1:d3:0d:fa:b1:ee:db:f5:65:99:d3:02:7b:80:5a:90:8a:78:d3:9e:7b:d4:54:43:3a:23:60:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

6788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Bld\125\822\bin\Win32\Release8\amselam.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

848B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/elam_ppl/win64/win10RS6/amselam.sys

IMPHASH 19914a0a128c4dadb1ba4e77a20e1f38
SHA256 927fa480ef9d4ffa528e3813604e1373983d3c1bdfd25808d0d886392d43958e
MD5 2c89a100c30bcff13fe0e6aab0e77f44
SHA1 d2508a3ec992926ded7be789de611a2645b3f454
SHA512 bdab44365c26b65eeefd7caa70ecfdaba1ac04c93559a938a665adf45da0b0c8fc0efa3b9486a7a6b893e7de0799f79a0da330a40adca3a9ebe3c03de2328975
SSDEEP 384:pRd4e6GW43CbZPYPufVUIFfoxOp1x09lEmEAO:p8e6GWjNQ21FwxOpwjO
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

e9:02:2b:1a:7a:63:56:a6:6b:0a:85:60:44:b2:06:e9:72:b6:a9:68:a3:35:84:ff:b5:50:5d:76:06:65:db:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

6192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\Bld\125\822\bin\x64\Release8\amselam.pdb

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

860B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/README

SHA256 006380095181e4291a88e1edd5c00258cdecd1c34e9d07a54ebca0a67b621578
MD5 8c4504c84273e7ec7be437cbd723cabd
SHA1 a10fb9ed6dbaaae70116726f5c002df7ab94542d
SHA512 5864d1a7140369857af54aa5db1437e1bcf2df127bb46f483a455f31a6950707b2a263e2911ae905cb659d4a47da4bb8f211c4df1a853525fa32d63385fa48c6
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avgntflt.cat

SHA256 7ee5e19106b3ef2df2a2026f7bbde9743faa0cc6cffe72b50cac858154c24a30
MD5 388bfd259a5523dc0eef0d7220ef7df0
SHA1 c086834640d289f5d6cdd5a8a0ad73b644608189
SHA512 485b9897f212ca92a00c512ade5ecaf129a7875ce6c86cf799fa8cc63fe1bee16f93d84dbbcce24be9d85c502fa9628cea1d8fb4650525e5c6f31d31ccefa528
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avgntflt.inf

SHA256 455ddf332e67840e44c59465cf96fb983d1641eec5e1db3f5c9c20bd5ec148a9
MD5 90786be47f7a15a7788db19168d85deb
SHA1 01dc85a5dff0ced5ef7bf090bab6a6424c477225
SHA512 131f35077eff86895a2d799f29a2b871edac8f36902e018a9f3af34906f4ad6a824bfdcbe4ea378555b42b59ffff5f8bc9f2b5c1ee61bbeb250c4162ad9d5d5b
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avgntflt.sys

IMPHASH 7e0b7a6b8c4a6a97b946117c9010b507
SHA256 d4f1608c1358e9096ecd5b26e1ff67ffaae061097050d0cd2fee2a03ad1c1864
MD5 6a8a0d1da0f9c43cae63052994a679e7
SHA1 52200af95d3d2136863d4d70646a8745b8116627
SHA512 02605e53d035277434124f8d0e90019a5945ead5f4f10a62df609fd300b5dbac000fb4059289b15ceb10ee5a4589dc981e46bfd57a0d657271a020f5e507afcc
SSDEEP 3072:BG0/ewd/JurIulKjCEe6Rar87j/s+L2LVBYE7i08xCvbx:BG0/ewd/JoIFv7jUmoYeOWbx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

ec:48:29:9e:2b:fa:44:7b:da:91:a0:5a:e9:18:2a:c8:10:8c:74:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 7, 2019

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

1

Major OS version

6

Entry point

156286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_x86\i386\avgntflt.pdb

ntoskrnl.exe

KeQueryPriorityThread SeQueryInformationToken KeLeaveCriticalRegion ExReleaseResourceLite ExAcquireResourceExclusiveLite KeEnterCriticalRegion SeCreateClientSecurity IoGetStackLimits ExAcquireResourceSharedLite RtlFreeUnicodeString RtlUpcaseUnicodeString ZwQueryValueKey ZwOpenKey toupper ZwReadFile ZwQueryInformationToken ZwOpenProcessTokenEx ZwOpenProcess _alldiv IoCreateSynchronizationEvent KeInsertQueueApc KeInitializeApc InterlockedPopEntrySList ZwDeleteValueKey ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject PsGetCurrentThreadId RtlUpcaseUnicodeChar ZwQueryDirectoryFile RtlAppendUnicodeToString ZwOpenFile wcsncat RtlAnsiStringToUnicodeString RtlInitAnsiString ZwSetInformationFile ZwQueryInformationFile InterlockedPushEntrySList IoGetTopLevelIrp NtClose ObReferenceObjectByHandle IoFileObjectType RtlEqualSid RtlGetOwnerSecurityDescriptor ZwQuerySecurityObject RtlNtStatusToDosError KeWaitForSingleObject _allmul IoThreadToProcess PsSetCreateProcessNotifyRoutine ExInitializePagedLookasideList ProbeForRead MmMapLockedPagesSpecifyCache KeResetEvent RtlIntegerToUnicodeString RtlCreateUnicodeString ZwSetValueKey PsCreateSystemThread PsRevertToSelf SeImpersonateClientEx RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsTerminateSystemThread KeWaitForMultipleObjects ZwWriteFile IoDeleteDevice IoUnregisterShutdownNotification IoDeleteSymbolicLink ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList PsDereferenceImpersonationToken _aulldiv _aullrem _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s RtlClearAllBits IoFreeMdl MmFreePagesFromMdl MmUnmapLockedPages ExWaitForRundownProtectionRelease MmAllocatePagesForMdl ExReleaseRundownProtection RtlFindClearBitsAndSet ExAcquireRundownProtection RtlClearBit RtlSetBit ExReInitializeRundownProtection KeTickCount KeBugCheckEx RtlUnwind PsGetProcessId IoIsSystemThread RtlEqualUnicodeString RtlCopyUnicodeString KeGetCurrentThread SeTokenType ExDeletePagedLookasideList PsDereferencePrimaryToken MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite ExGetPreviousMode MmIsAddressValid NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess memmove KeDelayExecutionThread _wcsnicmp wcscpy_s RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer IoWriteErrorLogEntry IoAllocateErrorLogEntry ZwSetSecurityObject IoDeviceObjectType IoCreateDevice RtlGetDaclSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetGroupSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAddAccessAllowedAce wcschr RtlAbsoluteToSelfRelativeSD RtlSetDaclSecurityDescriptor RtlCreateSecurityDescriptor ZwCreateKey ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeQueryTimeIncrement KeQuerySystemTime ExInitializeRundownProtection RtlInitializeBitMap KeSetEvent ObfDereferenceObject IoCreateSymbolicLink IoRegisterShutdownNotification ExInitializeResourceLite ZwCreateFile RtlLengthRequiredSid RtlInitializeSid RtlSubAuthoritySid RtlValidSid RtlLengthSid RtlAppendUnicodeStringToString RtlCompareUnicodeString IofCallDriver IofCompleteRequest IoWMIRegistrationControl RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess RtlHashUnicodeString KeInitializeEvent

hal

KeAcquireInStackQueuedSpinLock ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeGetCurrentIrql KeReleaseInStackQueuedSpinLock

fltmgr.sys

FltGetDestinationFileNameInformation FltDeleteInstanceContext FltGetVolumeProperties FltSetInstanceContext FltObjectReference FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltParseFileNameInformation FltQuerySecurityObject FltReferenceContext FltFsControlFile FltQueryInformationFile FltGetInstanceContext FltCreateFile FltClose FltGetStreamHandleContext FltSetStreamHandleContext FltReleaseContext FltAllocateContext FltReleaseFileNameInformation FltRegisterFilter FltStartFiltering FltCloseCommunicationPort FltUnregisterFilter FltBuildDefaultSecurityDescriptor FltCreateCommunicationPort FltFreeSecurityDescriptor FltGetRoutineAddress FltDeleteContext

Name

.text

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avipbb.cat

SHA256 868a019175ff5b006d50134331db3716b86610732adc8f5c63e3dc8bd1532ca9
MD5 f36e6a50e73e6314e2e86278d752e4c0
SHA1 66d2aa95fe43007565f51fc327d740363a3c57b7
SHA512 ef907672c24137fc9eeabf1a2d8fd7f12610a975c4ee85d4f0e26746be73084de7f0d3ee78c4703f27b6d3cf113af35ca362b12382c784158e6373a4718dc096
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avipbb.inf

SHA256 c75444741b52839a8ff89cb0dc483b6707492b8b67df195fec9610b0b844fa7b
MD5 44d0c248a5303802c341931cac34c81a
SHA1 979dd9a063cd0cb3bebe1ab659cdbe006619da63
SHA512 883513728967ff5c873780642c17e7f0f614c9ab65db643c4f46dedae9940f40c439bd5a06df0ae74a425753d86d0b05099e6bd0539c22733da62059b908a551
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avipbb.sys

IMPHASH 4a6708b112aea0a770a8d553371c7edf
SHA256 a59ad15322e353e99d6dc2a83166a9e9ac560cbf870ac038ad4065212dafd74d
MD5 fa54bc0638395be4b571f5ba3dda1c58
SHA1 2a7139069d6cc475dd008fdcb18359a4585cada9
SHA512 220a0a335674c55d2a3c9a2633477e1770c501e2a0be2b6b59ebb20f8cbdbfbe1acc207efd73d9df85dd889a2d6d6f57ad224ccc298984af9b697c0842cf05dc
SSDEEP 3072:2tpicpY21hip3mt/IN2O6YvLUmXNnPFTu5Q2MSvVeVOF/Qu0zY9Pn3Y:3cpLI92CfXNnP4+2MSgVwB/Jn3Y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

f8:e8:5a:d7:a4:fd:a5:0a:f1:db:7a:b8:76:6f:b7:52:d4:95:02:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Sep 11, 2019

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

159806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_x86\i386\avipbb.pdb

ntoskrnl.exe

IofCompleteRequest IofCallDriver KeServiceDescriptorTable ZwClose ObfDereferenceObject KeSetEvent KeReleaseMutex KeWaitForSingleObject RtlCopyUnicodeString ZwReadFile ZwCreateFile _strnicmp RtlCompareUnicodeString memmove ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject ProbeForRead ObReferenceObjectByPointer PsProcessType PsGetCurrentProcessId PsLookupProcessByProcessId FsRtlIsNameInExpression KeResetEvent KeReadStateEvent RtlAppendUnicodeStringToString PsLookupThreadByThreadId PsReferencePrimaryToken PsDereferencePrimaryToken SeTokenIsAdmin SeQueryInformationToken RtlAnsiStringToUnicodeString RtlInitAnsiString _stricmp PsTerminateSystemThread PsThreadType PsCreateSystemThread RtlInsertElementGenericTableAvl ExDeleteNPagedLookasideList ExDeletePagedLookasideList ExDeleteResourceLite IoDeleteDevice IoWMIRegistrationControl RtlIntegerToUnicodeString ExInitializeNPagedLookasideList ExInitializePagedLookasideList IoCreateSymbolicLink IoCreateDevice ExInitializeResourceLite KeInitializeMutex KeGetCurrentThread _vsnwprintf KeWaitForMultipleObjects ExGetPreviousMode KeQuerySystemTime PsGetCurrentThreadId IoReleaseCancelSpinLock IoBuildSynchronousFsdRequest ObReferenceObjectByHandle ZwWriteFile _allmul _aullrem RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv ObfReferenceObject ObOpenObjectByPointer PsGetProcessId wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy wcsrchr strncpy IoDriverObjectType wcscpy_s KeDelayExecutionThread KeTickCount KeBugCheckEx RtlUnwind RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag ExAcquireResourceSharedLite KeEnterCriticalRegion ExAcquireResourceExclusiveLite ExReleaseResourceLite KeLeaveCriticalRegion memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList IoDeleteSymbolicLink KeInitializeEvent ZwSetInformationFile ZwQueryInformationFile ZwQuerySystemInformation IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite MmIsAddressValid NtClose NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess ZwOpenProcess ZwFreeVirtualMemory ZwAllocateVirtualMemory ZwDuplicateObject RtlImageDirectoryEntryToData RtlImageNtHeader ZwQueryObject ObQueryNameString RtlDowncaseUnicodeChar _wcsnicmp RtlLookupElementGenericTableAvl RtlDeleteElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry

hal

ExReleaseFastMutex KeGetCurrentIrql KfReleaseSpinLock KfAcquireSpinLock KeQueryPerformanceCounter ExAcquireFastMutex

avkmgr.sys

func4 func3 func5 func1 func0 func6 func7 func8 func9 funca func2 funcd

Name

.text

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avkmgr.cat

SHA256 40b23a7d83bd3595a714918778249b6f999c8b016aee814207c893c8aa791e9f
MD5 8dbe5877f742d7d8fb652c84f76fab5b
SHA1 126f9190ef1822764e8d7d16bc14c4f03d0fffa9
SHA512 70fc63d4a4b101829a0e32135562cceb9ddebb36f907c96f01639b29248d4417af98dfa5ec8143e55db4e19c159c4a08a176bbcf2ff17a3ffe4627e7550fccf1
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avkmgr.inf

SHA256 9fedd6e956b7cd59180920ba7a6c94d0c0fa1dee867ed6087ba753ca47d21a37
MD5 e92853f21048c93a182a140e667983e9
SHA1 4265adb15d2f6ed70b7521d3887bd2304528ebef
SHA512 11617cc1fd33066ba4e54be9a174b7b4a610de66712299dbcd379d0f5b2cc4bcb1590c1719867129cac962619d0e04b25a177139a4c6f5b041c9c8711fc1b419
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win7/avkmgr.sys

IMPHASH df68c8435781307135dfe76497ab5341
SHA256 d5e35a021e2a8e676b9034a2c712907f170d3f5b7315d516f317f51cd03ddd06
MD5 20894c53c0b9db8f86993d9ecb78f9d5
SHA1 7c18c5b571c906535d393a5165379f6316143107
SHA512 7fbd637c64a3ed5ce202864197ee26e0d97f84be8bb0bfd5bdbfcf500f370764545489de8d83c347e5f15a414bf5d614377a60983803924935453266f8af5d24
SSDEEP 384:pSxWv2ZhZ4mAjuPUEA1aVrFiFdWeFuu9BTQe7r/nYPLvdJUHeMPP:gS8ZIuPwoz4dWeFuubQEr/KdkP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

0e:11:dc:93:87:33:df:91:40:f0:90:a9:a0:f6:04:da:25:c2:45:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

36926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_x86\i386\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

846B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avgntflt.cat

SHA256 53d97aa50393ca150fcdec5cc8e301c41c1115de0fd1a5cdfe888bc1ca6c7160
MD5 b8c79e6cfc02b9a0b8b82ed553f9166c
SHA1 376cd0763508ec17c11a3a026f29a9c80b6e6afa
SHA512 a79ffbfd5d1bd99f722a5eda7e61696194c8943c26b1fca183eb524937e3f2b07c20b4de27853adbcf1b1d839ee37f09c575c8f960e847fc3d648495ec81c553
SSDEEP 192:vDnyq1JC0E4uyK6iWPFWQFIiQXNpVwyqnajluGFmbhiT/:t1hiWPFRtkvl4G57
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avgntflt.inf

SHA256 1bb8e4f5c84ef97e6040e85ab0bc6096af0a1e60b1f816b77df2825cfacc7427
MD5 3dd9d84fbb36673790a325616f46ed41
SHA1 a5fe04fc7e312149a6dea0103d64a6330de823b7
SHA512 7380d7b38ac0498d64ade84444ab31bafef40e112cdba24564a899e89d09f5a60d07e423a78de8f6002a5c356665abdaf58c77424035e64a3b5986cdfe46bf00
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avgntflt.sys

IMPHASH 4da638de60b7c35dc73116b3dd0f9868
SHA256 7c4daa6d040aea3ed2f775e1282ff799342d84957e2ad803ff856b414ae478b8
MD5 c051f6d6f9cca6ba44769c9f3c5e08c1
SHA1 fbd708222412f8a93790b6252fc872d6bb285805
SHA512 a85af9258906a683e004daf2f9a022aa3227e4ed1e01b1ba1a7dcbec72c03b89af741404405552f02da48798bd2a47950578ec329557bba644ca45441740d07a
SSDEEP 3072:u4+wW40T059lGsMSQ/YafavrVYublgTUDs32HaLiOd60i9br6:5+w8T05q1QaEVYublg6la33i9C
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

156256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avgntflt.pdb

ntoskrnl.exe

RtlUpcaseUnicodeChar RtlFreeUnicodeString KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion InterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc _alldiv memcmp ZwQueryInformationFile ZwSetInformationFile InterlockedPushEntrySList IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetBit RtlClearAllBits RtlFindClearBitsAndSet ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine RtlAppendUnicodeToString KeResetEvent ExInitializePagedLookasideList ProbeForRead ZwSetValueKey RtlCreateUnicodeString _allmul _aulldiv PsDereferenceImpersonationToken PsCreateSystemThread PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _aullrem _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry memmove RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp PsDereferencePrimaryToken RtlUnwind RtlCopyUnicodeString RtlEqualUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString KeGetCurrentThread wcsncat RtlIntegerToUnicodeString toupper IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors memset memcpy RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeQuerySystemTime KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress KeWaitForMultipleObjects RtlInitUnicodeString

hal

ExAcquireFastMutex KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock KfReleaseSpinLock KfAcquireSpinLock KeGetCurrentIrql ExReleaseFastMutex

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltParseFileNameInformation FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avipbb.cat

SHA256 d657a6d558bf4ffbfd98635d6ed710cb696d014401f239767fea24694c9e6b9d
MD5 e6d91dd3acddb2db9599f14ef8d27ac7
SHA1 fb1f0ce044e7e52494d1cbac481e3a0de986639c
SHA512 8a2661a3523a35919158f4d753f6a8761b73d4f0c584101fed0de91aa02264f3ca412dfd7a2995501f6d66289fde281d9b9b1f73b31c9761782e418c1575c2fa
SSDEEP 192:ZHuERnRdy9kJCWZvgRyK8UFWQFxLQfLux5Dqnaj0CC:ZnRDxR5UFRT3Dl4CC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avipbb.inf

SHA256 fd8f20991375a3b90c28efd32b6f1f3d7a146b442d7045503eccd11b7d841052
MD5 c671a35e5e6fd4f339456282e5f60355
SHA1 7caa5f34177c6506b57244b6f178a3141c6dcdef
SHA512 c5e238f5161894e97c90588c97ae114aa88349ddc5bfa46d78ed7ecb88abca7cd62ea1bcc3fb0d6eb8f1fa5bb3a572a2e9eafecca7f528794f7ba49b7754e4c8
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avipbb.sys

IMPHASH fffb1de604a85c27995466f9f3d4ee66
SHA256 683f4be712e2ebf43605228c922bf8290ac488aeb6217508e76c9762d4ccfe2e
MD5 42acd4d23a3fc8c8a24c98d8ba46006b
SHA1 decec09fdca578b2fd52bd1c154245447d632f1e
SHA512 8f652dcbc65b38e3979fae178e015d721be97bed92fe4bd06d6951a55e263b7a4c10e68454cfb5ada52a376391dd1ac24b1e01e6d16699f472598c0690392d1b
SSDEEP 3072:51tN34a9rnwdmrOxVUvOK/1n4O11bMMQwKiYBlQuugmTi1ZJcL:52gwkNn4OTIMQwK7BlBupm1O
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

172032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avipbb.pdb

avkmgr.sys

func7 func8 func6 funca funcd func5 func4 func3 func2 func1 func9 func0

ntoskrnl.exe

RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite PsCreateSystemThread PsTerminateSystemThread IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId SeTokenIsAdmin SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken PsLookupProcessByProcessId PsLookupThreadByThreadId FsRtlIsNameInExpression memcpy memmove memset KeNumberProcessors PsProcessType MmGetSystemRoutineAddress KeServiceDescriptorTable KeGetCurrentThread KeWaitForMultipleObjects KeQuerySystemTime ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf _allmul KeInitializeSpinLock RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv _aullrem ObfReferenceObject PsGetProcessId ObOpenObjectByPointer ZwQueryVirtualMemory wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcscpy_s wcsncpy wcsrchr IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose ObQueryNameString ZwQueryObject ZwDuplicateObject ZwAllocateVirtualMemory ZwFreeVirtualMemory ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlImageDirectoryEntryToData RtlImageNtHeader RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry memcmp ZwSetInformationFile RtlInitUnicodeString RtlUnwind RtlInitAnsiString RtlIntegerToUnicodeString _strnicmp _stricmp RtlAnsiStringToUnicodeString PsThreadType

hal

KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter

Name

.text

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avkmgr.cat

SHA256 4f7410877d36f20a802c5db603149a33beed2d10e3e83f6c5372e52be42fdae0
MD5 a63897b79888e60e29431eb1b28844de
SHA1 86feb4a8ff0beda3b6c349fbf17c7b6a37e771db
SHA512 b176be196dd4967b28305a4f59325034b8ec4e7b544a2011f8b8f908a8154db8d86a3183e25b22232597024d04bc536d42556df89fea3169f0c21251da27ef9c
SSDEEP 192:3i9X2cACJCztpyKWFWQF82QKZ8fNLyFqnajktKF4m:wAC5FRRte1olwkF4m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avkmgr.inf

SHA256 431367c384e680b0f4feafaf7529319ab2cc3cd37bccd291b46c711fa49204ff
MD5 dddb1f6ae43397a15af280de3ebc3c83
SHA1 2651935088949e2dff211a7c1126a02836a9b781
SHA512 6b5d7715d691d18647d1cdf5e3d3bcaae84fa9614378770d544e0263261b99539977922632acbed76a520aebe045396635e45dec9defa9527500f5889d9e8069
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win32/win8/avkmgr.sys

IMPHASH 915211291455160b181a1b35daf6bd20
SHA256 5fdde96d05b4284fa7ee985a7777739c46040ad89b3b8217a729da9695e3e542
MD5 e3ab0eeb7613ddbacc0388b96048ff5d
SHA1 f6e382597081451d6546339948edd3e854b7dfae
SHA512 40c0c7ac884297350a40d58a6a870796381ccb82ade22d69ca3cb9be0c3251b8768f95ab4b0f28f209ed65aed23894a7e77529316250ace7e5da8a99d0bb81a1
SSDEEP 768:ginpYN85Ry72IqbyReYU6uPwoz4djHIEoF+NdKduH1Qk8AI24o3whJ:BpsK64yRGwospoJFsEuH+k8AH1ghJ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

36864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Bld\128\795\bin\Win32\Release8\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avgntflt.cat

SHA256 b99e22863acd4f8ae1aa30727e80305d3cce171d67638cc84264bbe796715aab
MD5 c407cd984c328f861a0cc4d0e210eeae
SHA1 fb30aee0ae5f61d40fa2f8c3987ae0d1fa3af698
SHA512 01f15c16dcfff79f9eaed78692b41f01d54d753dffd2547a558ea5ef6286596e5198c70f2a1b6fca951f091ba1ea6b09c5c849a48f87dfda70182fe7969ac492
SSDEEP 192:HEG324UBqpmMBWJdZ2Mf5rfoEXpBjSwnQQTthiO:kLmmJdZ2OfXXpBjZnBthv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avgntflt.inf

SHA256 1bb8e4f5c84ef97e6040e85ab0bc6096af0a1e60b1f816b77df2825cfacc7427
MD5 3dd9d84fbb36673790a325616f46ed41
SHA1 a5fe04fc7e312149a6dea0103d64a6330de823b7
SHA512 7380d7b38ac0498d64ade84444ab31bafef40e112cdba24564a899e89d09f5a60d07e423a78de8f6002a5c356665abdaf58c77424035e64a3b5986cdfe46bf00
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avgntflt.sys

IMPHASH b398f90ffbc660b3ba4ceb9adfec4ec9
SHA256 68585445ed23b1c0270fefb49e1cf29a38c8fe7c92479e7793d237cb67134c34
MD5 cb12d21a7e4c43acb5f000bb035957bc
SHA1 8ac8d5be7b1758626fedab60626c7a09e2a257e7
SHA512 0cf9c598dd76b496b8dc2f33c19bf7023e0e31e3ca63e7667ae57ad563a2b9b612eee0ad79285e050f8e22f873634d6e9e80749800c073761a1766f3a36967b2
SSDEEP 3072:kJfhiNwrOpCnINCLK8WfUGcquO56s5VYLlYRtdyUR8G5nRn/tn2KmxlM:kJfwNnpCIoa8GcqD56w2L6hy08G5WlM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

40:f1:fd:fb:e0:2e:de:ec:bb:f9:ab:f9:d9:0b:8d:45:ef:76:87:e8:83:b2:6e:b1:75:d3:f9:7e:70:b5:e6:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

2f:a1:4a:3c:71:ed:eb:f4:ee:f7:94:c8:5c:d8:d2:52:e4:3a:f5:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 7, 2019

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 5, 2019 - Jun 3, 2020

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

230332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_amd64\amd64\avgntflt.pdb

ntoskrnl.exe

ExAcquireResourceExclusiveLite IoThreadToProcess RtlUpcaseUnicodeString KeLeaveCriticalRegion RtlAnsiStringToUnicodeString IoGetStackLimits ZwQuerySymbolicLinkObject ZwReadFile KeInitializeApc KeInsertQueueApc RtlAppendUnicodeToString RtlInitAnsiString ZwDeleteValueKey wcsncat KeReleaseSpinLock ExpInterlockedPopEntrySList RtlEqualUnicodeString ZwOpenSymbolicLinkObject KeEnterCriticalRegion ZwOpenProcessTokenEx IoCreateSynchronizationEvent SeCreateClientSecurity RtlFreeUnicodeString ZwQueryValueKey ZwQueryDirectoryFile ExAcquireResourceSharedLite ExReleaseResourceLite SeQueryInformationToken ZwOpenProcess toupper PsGetCurrentThreadId RtlCopyUnicodeString ZwOpenFile ZwQueryInformationToken RtlUpcaseUnicodeChar IoIsSystemThread KeQueryPriorityThread PsGetProcessId ZwOpenKey KeAcquireSpinLockRaiseToDpc ZwSetInformationFile ZwQueryInformationFile RtlEqualSid ExpInterlockedPushEntrySList ZwQuerySecurityObject IoFileObjectType RtlNtStatusToDosError NtClose ExQueryDepthSList ObReferenceObjectByHandle IoGetTopLevelIrp RtlGetOwnerSecurityDescriptor KeWaitForSingleObject PsSetCreateProcessNotifyRoutine ExDeletePagedLookasideList ProbeForRead RtlCreateUnicodeString KeResetEvent RtlIntegerToUnicodeString ZwSetValueKey MmMapLockedPagesSpecifyCache ExInitializePagedLookasideList RtlDeleteElementGenericTableAvl PsCreateSystemThread PsTerminateSystemThread SeImpersonateClientEx PsRevertToSelf KeWaitForMultipleObjects RtlEnumerateGenericTableWithoutSplayingAvl ZwWriteFile IoDeleteSymbolicLink IoDeleteDevice SeTokenType ExInitializeNPagedLookasideList RtlHashUnicodeString ExDeleteNPagedLookasideList _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExReleaseFastMutex ExAcquireFastMutex RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl RtlInitializeGenericTableAvl sprintf_s MmUnmapLockedPages ExWaitForRundownProtectionRelease ExAcquireRundownProtection KeReleaseInStackQueuedSpinLock ExReleaseRundownProtection KeAcquireInStackQueuedSpinLock MmAllocatePagesForMdl IoFreeMdl RtlSetBit RtlClearAllBits RtlFindClearBitsAndSet ExReInitializeRundownProtection MmFreePagesFromMdl RtlClearBit KeBugCheckEx IoGetDeviceObjectPointer _wcsnicmp KeDelayExecutionThread ZwQueryInformationProcess wcscpy_s RtlInsertElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry IoCreateDevice ZwSetSecurityObject IoDeviceObjectType _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor RtlAbsoluteToSelfRelativeSD IoIsWdmVersionAvailable SeExports wcschr RtlAddAccessAllowedAce RtlGetSaclSecurityDescriptor RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor ZwCreateKey PsDereferencePrimaryToken ExDeleteResourceLite PsDereferenceImpersonationToken PsGetCurrentProcessId ObOpenObjectByPointer ZwClose IofCallDriver RtlLengthSid KeNumberProcessors ExInitializeResourceLite ObfDereferenceObject IoCreateSymbolicLink RtlCompareMemory RtlInitializeSid RtlCompareUnicodeString IofCompleteRequest RtlAppendUnicodeStringToString KeQueryTimeIncrement IoGetCurrentProcess ZwCreateFile ExInitializeRundownProtection RtlInitializeBitMap RtlValidSid RtlGetVersion KeInitializeEvent MmGetSystemRoutineAddress KeSetEvent RtlInitUnicodeString InitializeSListHead IoRegisterShutdownNotification IoWMIWriteEvent ExFreePoolWithTag IoWMIRegistrationControl ExAllocatePoolWithTag RtlLengthRequiredSid IoUnregisterShutdownNotification RtlSubAuthoritySid __C_specific_handler

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltSetInstanceContext FltDeleteInstanceContext FltDoCompletionProcessingWhenSafe FltGetFileNameInformation FltSetStreamContext FltCancelFileOpen FltGetStreamContext FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltParseFileNameInformation FltQuerySecurityObject FltReferenceContext FltFsControlFile FltClose FltQueryInformationFile FltCreateFile FltGetInstanceContext FltReleaseFileNameInformation FltAllocateContext FltReleaseContext FltSetStreamHandleContext FltGetStreamHandleContext FltStartFiltering FltRegisterFilter FltBuildDefaultSecurityDescriptor FltGetRoutineAddress FltCloseCommunicationPort FltUnregisterFilter FltFreeSecurityDescriptor FltCreateCommunicationPort FltDeleteContext

Name

.text

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

19B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avipbb.cat

SHA256 a1a3ccc5feea86aa08dd19b4717913df9430996a04fa444eb9f44456b8cd6ad5
MD5 f7139f2ba9a6ffa9e1d3c0c1b4dca506
SHA1 ccaad0fa94a251706b7f4156e47a9cdeedb12dcf
SHA512 ab9e2cf766c1acc21a7d26364be2aa62183cb6e38795dd6990df87f80956cebca0a23c2fbecdd3795ec6efcf301a845c63beda6f58a64b270ef685aa78c08ccf
SSDEEP 192:avV32ZYC6a1Yd3wZdZ2Mf5rfoEXpBjSwLQ2wx:avJC6MPdZ2OfXXpBjZLM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avipbb.inf

SHA256 4cf97cbe014d1c1f3afcbe6f2534e0536fb1bbe42c42bb096f35c86b239109f5
MD5 cad7c5e0e6a37588061084878c0a7e2e
SHA1 13c7bbbfd58edd4fa8d9b6565e8274fba7b65c98
SHA512 20b9a0a0e182db1e29fa53f734ca054c85b02218e82ab81b8db140b3e3975fbdc3d0fe5c53ab925025ed011d50a7ab4945670aca1ca54fd393d2fc8bc44e5825
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avipbb.sys

IMPHASH 03ab424c5032a15c20d0c7b3945b6abc
SHA256 05fd91ca74c7d6549b95c590fc2806087b2a70c293a70474de62c53d65f0d8e8
MD5 056c365df7a98ad0e67616ef14444f4a
SHA1 9c15d77ad5bd5fa247cfbe09d21246def22cc86f
SHA512 c6bcc81b7dd6a4530846cb8ce209c74de3342b55b09b69e29e8906eb68eed75eed6446f43f5c6fa3c353a27f0afe0e90c1bb77366cb9aa72fbe74729d475722e
SSDEEP 3072:1OfS4igtz86CkVkzDmVSbYLsEXei/W9Quxyh67:M1Np86CBdb3i/EBD7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

fa:55:ca:9a:0a:0c:c6:54:1d:4e:25:b4:be:94:62:c1:a4:f4:f8:53:e3:5b:23:02:d0:4f:c1:85:15:6a:33:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

e7:d6:ea:79:ae:67:98:bd:a0:4b:53:bd:ee:99:25:8e:c5:b6:a1:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Sep 11, 2019

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:86:db:2a:87:44:f4:39:4c:a4:00:00:00:00:00:86

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 5, 2019 - Jun 3, 2020

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

176228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_amd64\amd64\avipbb.pdb

ntoskrnl.exe

KeReadStateEvent KeInitializeMutex KeLeaveCriticalRegion RtlAnsiStringToUnicodeString ExInitializeNPagedLookasideList ExAcquireFastMutex PsLookupProcessByProcessId ZwQuerySymbolicLinkObject ZwReadFile RtlInitUnicodeString RtlIntegerToUnicodeString IoDeleteDevice KeSetEvent PsReferencePrimaryToken ExpInterlockedPushEntrySList MmGetSystemRoutineAddress KeInitializeEvent RtlInitAnsiString RtlGetVersion ExpInterlockedPopEntrySList ZwOpenSymbolicLinkObject FsRtlIsNameInExpression KeEnterCriticalRegion KeReleaseMutex ZwCreateFile ExDeletePagedLookasideList ExAcquireResourceSharedLite IoGetCurrentProcess ExReleaseResourceLite ZwClose RtlAppendUnicodeStringToString IofCompleteRequest ExQueryDepthSList SeQueryInformationToken KeWaitForSingleObject RtlCompareUnicodeString RtlCompareMemory ExDeleteResourceLite IoCreateSymbolicLink PsGetCurrentProcessId RtlCopyUnicodeString ExReleaseFastMutex ObfDereferenceObject IoCreateDevice ExInitializeResourceLite KeNumberProcessors ObReferenceObjectByPointer ExDeleteNPagedLookasideList PsLookupThreadByThreadId PsDereferencePrimaryToken IofCallDriver IoBuildSynchronousFsdRequest ExGetPreviousMode _vsnwprintf ObReferenceObjectByHandle PsGetCurrentThreadId KeWaitForMultipleObjects IoReleaseCancelSpinLock ZwWriteFile KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl PsThreadType RtlEnumerateGenericTableWithoutSplayingAvl KeAcquireSpinLockRaiseToDpc wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy strncpy IoDriverObjectType wcsrchr PsGetProcessId KeDelayExecutionThread KeBugCheckEx KeResetEvent IoWMIWriteEvent ExFreePoolWithTag IoDeleteSymbolicLink PsProcessType IoWMIRegistrationControl ProbeForRead ExAllocatePoolWithTag SeTokenIsAdmin _strnicmp RtlInsertElementGenericTableAvl ExAcquireResourceExclusiveLite ExInitializePagedLookasideList _stricmp ZwSetInformationFile ZwQueryInformationFile _wcsnicmp RtlDowncaseUnicodeChar ZwQueryObject ZwQuerySystemInformation ZwOpenProcess ZwQueryInformationProcess RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry __C_specific_handler

hal

KeQueryPerformanceCounter

avkmgr.sys

funca func8 func5 func0 func2 func7 func1 func4 func6 func3 func9

Name

.text

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avkmgr.cat

SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
MD5 f3324c2c121d360f8ce3553e221c3ce6
SHA1 85939054d39067cc7e1089de71138b4b4283f800
SHA512 045db8fab56ab1c4ff0cea326cd44624c3bbab2d042b3065541707bec0021b669e6a49fcb2adf502fbea38dd4823e85fe0f2c588f93efeae4108239ae1271c78
SSDEEP 96:SZR2gYJUzSDaSDqhRwUWcGDvbop6WDfeRDUzxwLhPjkFokPXhVEM0YDfez6rEfga:S32HmX0c0YWEhV0+3Ef5KYpBjSwrQa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avkmgr.inf

SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
MD5 176af3c43b608af665f48a35f497bae1
SHA1 e992df632b9758b3df7b4ea69c632f12a03daaf6
SHA512 03cec71f9ca56d99304b6dff1b90a2ca5d04bf5cf7cd0e41e1134cdb1cac50540d6e3bec18313f970420af4bf29d76653e9c5a9fa1351d1747989dfafc208493
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win7/avkmgr.sys

IMPHASH bbbf29be00d696bbac6e5abddd6e312c
SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
MD5 eb5c2402e2f402a19504bf6ca9c3e06a
SHA1 63aa9690c36d743951558422d841276c25cde77d
SHA512 9b6b7c06e904cf36aefc17e14a108e9636c3a8920a34960dcb26fa520326c7ff47f03c24bacaec6ba91440237fb16afde0df01c299cdd7a89c40cc489a3f0151
SSDEEP 768:p5UbgvCkoe+nuPwoz4dC2xfDKKdqe0nKUbZ:88axeLwos42xfDpqevq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

67:03:5e:7d:2d:97:2d:65:2b:25:6f:b7:39:13:c4:12:e0:cf:0a:5f:c3:7f:d1:d6:5b:ce:39:2e:35:ec:d8:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

5a:6a:8a:38:66:a5:ea:f2:62:5c:0a:0e:de:29:fb:20:b7:df:d1:db

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2018 - Sep 20, 2019

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

32868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_amd64\amd64\avkmgr.pdb

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

406B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avgntflt.cat

SHA256 1e68db7ab6df620cf8c9d7ea80275925df982e4ad3d513eeec758c85477f89dc
MD5 aec89e04f905d6cbbf96c4dda500a37d
SHA1 e1bc37bf9f28a259d4bfee41170a34c82170fafc
SHA512 f5d5b33fd394d0e9d2a0763dfb47a3614e13047eaa768e8be9425add64d501ff3607c7d92e52c2257793f108203a1cfc1252e286201653d950e2d4fcb9ecb233
SSDEEP 192:VDvyQJCkE4uyK6iWPFWQF8oQQ9i5M8xOSqnaja94G1:NBiWPFRzxPCTlOmQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avgntflt.inf

SHA256 1bb8e4f5c84ef97e6040e85ab0bc6096af0a1e60b1f816b77df2825cfacc7427
MD5 3dd9d84fbb36673790a325616f46ed41
SHA1 a5fe04fc7e312149a6dea0103d64a6330de823b7
SHA512 7380d7b38ac0498d64ade84444ab31bafef40e112cdba24564a899e89d09f5a60d07e423a78de8f6002a5c356665abdaf58c77424035e64a3b5986cdfe46bf00
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avgntflt.sys

IMPHASH 405842826b83b55c6c2db2fb9269856f
SHA256 d7e219b7d9e49fab68d06b21e88371645756045aa30081701d98751259da6b99
MD5 654fe9c2688b07c2eb14d12a52736e7b
SHA1 4f96d0cc4391913239f5c1bd090e050dbb90876f
SHA512 ce43a12921ca8ea3c05c69c55ad8c99b5863d609989aacd46ba7f9bffdbf07f78ff18cfbce8436181fea88b08fac8b3b9010770ced47e3a4ec7b021bee67551f
SSDEEP 6144:eDNH/pU01GDgY343CjRcc+bOgIi7PxfMPtpwkJmB:eDNBU01GD/1nAOgIi7PLKc
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

201392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avgntflt.pdb

ntoskrnl.exe

RtlInitAnsiString RtlAnsiStringToUnicodeString RtlEqualUnicodeString RtlCopyUnicodeString RtlAppendUnicodeToString RtlUpcaseUnicodeChar RtlFreeUnicodeString KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock ExpInterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc ZwQueryInformationFile ZwSetInformationFile ExQueryDepthSList ExpInterlockedPushEntrySList IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetBit RtlClearAllBits RtlFindClearBitsAndSet KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine RtlIntegerToUnicodeString KeResetEvent ExInitializePagedLookasideList wcsncat ZwSetValueKey RtlCreateUnicodeString __C_specific_handler KeWaitForMultipleObjects PsCreateSystemThread PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExAcquireFastMutex ExReleaseFastMutex RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp toupper IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey PsDereferenceImpersonationToken PsDereferencePrimaryToken SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite InitializeSListHead ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress ProbeForRead RtlInitUnicodeString

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltParseFileNameInformation FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

3B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avipbb.cat

SHA256 0ef3651a0b3fda24e18943675fc642f5b540f4cdd495e3d17fc2cc7d62b91c60
MD5 5f7c6c06ca7cbe76ff1132b5b5db171a
SHA1 70781589e998494b46075e37dc65a848ffecd811
SHA512 f1927fe5e03fc3fdaad0cfa9a2f2d7371c6c44c4f8b08734f8d00545453555a7c12d7fef3ea97aaf77fb0c7b0a48a5a440bb837104c1c378b2309cb4915d6745
SSDEEP 192:CH7RrR9ylEJCmZvgRyK8UFWQFx/Q5NDUtpwBqnajrQmVx:CVl7RR5UFR3UWqlAm/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avipbb.inf

SHA256 99fac6d236147986d206b2b69873b9de8f156b1fb3d909c57ff33954fc5afd0d
MD5 d140a56472b7b1aa65d2823738edcb81
SHA1 60bd23215fe6cf9a7891ee26a0129994839faf9a
SHA512 2192c3d5a8e7e8ea7a443237aacc401ac0b68b7c47cf610a989776082ded4286954ed84313390fcdcf990f46391aba462a9c6f62f8d9162b09bb18fdf6ef7b93
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avipbb.sys

IMPHASH 7faea936002c5a479c9aa12684780345
SHA256 a257e4e9a10658a1f5d7a98b6e29f678ffcf7208fd0a75cf92576cb1a1585e2b
MD5 5b1de9574012d42c29a051f862a9f185
SHA1 d577e6cb54ab788fd093d3b6675ae8e23d5733b6
SHA512 d151ce55153c32c32fece8e9589adb862af98b06d47793a03d540411066defb05f834a665f389ee18e173b64853e81fd63872ccc109fa82ab3c20e854906468b
SSDEEP 3072:d9tiEzBdPGc85RQlzKsmXkiVP/qAS0qwvHLcaQuB0Gs7Bgr:dvD8GGx/00qwvQaByV9a
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

188416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avipbb.pdb

avkmgr.sys

func2 func3 func4 func5 func1 func7 func8 func9 funca func6 func0

ntoskrnl.exe

RtlIntegerToUnicodeString RtlInitAnsiString RtlInitUnicodeString MmGetSystemRoutineAddress RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag ExAcquireFastMutex ExReleaseFastMutex ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId SeTokenIsAdmin SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken PsLookupProcessByProcessId PsLookupThreadByThreadId _stricmp __C_specific_handler KeNumberProcessors PsProcessType KeWaitForMultipleObjects ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsThreadType wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcsncpy wcsrchr PsGetProcessId IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose ZwQueryObject ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry wcscpy_s ZwSetInformationFile _strnicmp FsRtlIsNameInExpression

hal

KeQueryPerformanceCounter

Name

.text

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avkmgr.cat

SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
MD5 88ae7b9879c9ac3a65ef73424600ba65
SHA1 67f74e5f569aed30bda54b5a6467d86d0110e448
SHA512 5b87166c206dee390e81a3ad334578a9b1ca7274b677af3cfeb2c6cfe46b756a59df78b0ea5ab7c1e11d3465f5955e58bac8dd45daeda61ac683ae53388c3dc8
SSDEEP 192:niBT2KJC2tpyKWFWQF8ESQ85SD7Zqnaje1cwrxFh:+mFRTS9Ell61cwrxn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avkmgr.inf

SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
MD5 fabaac0d5c0ef083150dec8615a8b2bb
SHA1 23b864f150922bd020b679e018b1b0ee59a7353f
SHA512 51cac3b029a5ec11ba36e8b7ad86b720da7e6546cb4ba8cad319200892ff143e9664e4a29d915a79f4a302b15078e44f0bc934715b8fcf8deaef4d7e3dde5801
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/win64/win8/avkmgr.sys

IMPHASH 1a89cb31ddbe098dfbe56321442ce0b1
SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
MD5 40786e1ac650f9f7e8b67a672b5eb69e
SHA1 f529c7b666b029e19a301a30463abcadd59f4b0b
SHA512 da8453b4d97dc4994a6db2fbdb741119513bd007078bc352b664f77790a7c7de876f038943cf826dbab81962bc5551f506dc04e7d69945bf324f3a23a5e9e6ba
SSDEEP 768:Z6e6av+nuPwoz4d0ggKdeql0dsKI2Nr3h+1y:ZuavLwosugz3aHR3h+s
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

32768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\Bld\128\795\bin\x64\Release8\avkmgr.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

342B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/plg_fops_dummy.dll

IMPHASH 6e6a20127c71bd569afdd3603c699d26
SHA256 861dd01a5ea887b63a0c4f03da845d8a56962470dfb5721914b5e59d718aff49
MD5 a3be5b7d616f9353bf9cc25b6bb53df1
SHA1 4900434b9836705cda97c76f31abc109d040328f
SHA512 6de5f3396ef23bfacdd8fcffb1710cf36aafc7af929db0c20e38a2e6cf19f00a6b3b832c7562244c9bdce8d78ec093596a3d0ce994c4593424bf1eff1de5cc8c
SSDEEP 3072:49EflB35SR4AmoiEjToSyrgLZuQk9o7vnaOFx5+m:sE7hAIGBLZuQkuFT+m
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

6692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\r5hd573d\utils\SDK\examples\cmake\advanced\plg_fops_dummy\plg_fops_dummy.pdb

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType CloseHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetCurrentDirectoryW GetFullPathNameW MultiByteToWideChar CompareStringW LCMapStringW SetStdHandle GetStdHandle FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation GetStringTypeW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW DecodePointer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/productname.dat

SHA256 9fa0b63b2c5e1a81a6e7b1d6d351fb845c23fd4d67b8c870b9a850ff0e1fdd12
MD5 7d05bf5029c22f26a9ab1de66f254c2c
SHA1 158e3ee360485045be46d4de9cc940437976dc40
SHA512 9021ddc6de0b842a043c3d67aa652001ebc78afe7472b391393bd78e49e04a9ef62dc63eb8377a1c0d8d8518f323b320e64df2962e6e7b36f825ca096291cfb9
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi.conf

SHA256 8675d81b5034235ab6cd8be2556d146b1b713534b6bc850af5e1378b5ce4db0a
MD5 c7ea6cb9e75ec33d0053a4563e4f4822
SHA1 c370b6b31066ab884b42b7830efc18e7d871ef45
SHA512 b960ce8d780e4de419f60e917777c70dc1a991515e26011025c0c2cd2933ac4cfcbe0f272ce38cf7bcb3612a7dd6daebba40e043c17844dfa56c74094ea573c5
SSDEEP 768:DjOPeA2HF0O/qHJTWMmIAY8jr5+6OpQOSV68a:BAQdo5XWY6OpQOSV68a
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi.dll

IMPHASH 4d69623e0252403fd8c9a1ebee67d564
SHA256 2659db9966b5b70a42c5b973443d6e1f633156e3a9538612397a6127e87c92da
MD5 0d3d6248b08ae3601ec2241fb71ddcf8
SHA1 ebce807730af996834b1998c537123c9284ead1d
SHA512 04c19b8e778abba00e7e6a913097731919e76ebbfb70fc4ff9f6b2b620889c0b579e7c5d6e47da0a5cf370258db84883955ee8a71aca53de9e6a7b1fd28b426f
SSDEEP 49152:JZ7VuSiBHQ0xQgg7anyhBaee6zwK5Z5ERUh5MHSPZC2GNCRgSwJE9:JZ7VuVHnQgg7anyhBaZYZ5DERqiHCC25
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8f:07:6c:ab:43:2f:b2:0c:0b:0b:4c:83:f4:1e:5f:44:d2:2d:7e:3c:0e:73:ff:6a:f1:c8:57:fb:b2:09:ed:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

2007624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\libsavapi\daemon\libsavapi.pdb

ws2_32

WSASetLastError WSAIoctl inet_pton send recv inet_addr WSAStartup setsockopt ioctlsocket WSACleanup WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getnameinfo freeaddrinfo getaddrinfo getservbyname htons htonl getsockname getpeername socket shutdown select ntohs listen getsockopt connect closesocket bind accept __WSAFDIsSet ntohl gethostname WSAAddressToStringW WSAGetLastError gethostbyname

mswsock

TransmitFile

rpcrt4

UuidCreate

shlwapi

PathFileExistsW PathRemoveFileSpecW PathCanonicalizeW

kernel32

MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CloseHandle GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW QueryDosDeviceW InitializeCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetStdHandle SetStdHandle CreateFileW DeleteFileW SetFilePointer DeviceIoControl GetOverlappedResult CancelIo MoveFileExW FlushFileBuffers ReadFile WriteFile PeekNamedPipe ReleaseSemaphore CreateSemaphoreA SetLastError GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW CreateDirectoryW FindNextFileW RemoveDirectoryW GetCurrentProcess GetCurrentThread OpenFileMappingW FormatMessageA DuplicateHandle SwitchToThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent SetHandleInformation GetTempPathW CreateFileA GetVersionExA GetModuleFileNameA LoadLibraryA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA FormatMessageW GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LoadLibraryW CreateEventW VerSetConditionMask GetEnvironmentVariableA CompareFileTime WaitForSingleObjectEx MoveFileExA GetModuleFileNameW GetLastError DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GlobalFree VerifyVersionInfoA GetSystemTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedFlushSList RtlUnwind RaiseException GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleCP ExitProcess SetConsoleCtrlHandler HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetTickCount GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency SleepEx InitializeCriticalSectionEx CreateHardLinkW CreateFileMappingA GetCommandLineA GetProcessHeap GetStringTypeW HeapSize GetVersionExW GetNativeSystemInfo GetCommandLineW

user32

GetSystemMetrics GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

RevertToSelf CheckTokenMembership FreeSid CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus DeregisterEventSource RegisterEventSourceW ReportEventW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl AllocateAndInitializeSid InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW RegSetValueExW RegCreateKeyW RegCloseKey

shell32

CommandLineToArgvW

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

crypt32

CertGetCertificateContextProperty CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertFreeCertificateContext

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

CharToSTCHAR SAVAPI_APC_cache_operation SAVAPI_APC_get_version SAVAPI_APC_initialize SAVAPI_APC_uninitialize SAVAPI_FPC_disable_preinit SAVAPI_OA_create_instances SAVAPI_OA_initialize SAVAPI_OA_start_scan SAVAPI_OA_stop_scan SAVAPI_OA_uninitialize SAVAPI_TCHAR_free SAVAPI_char_free SAVAPI_create_instance SAVAPI_engine_modules_get SAVAPI_engine_modules_get_ex SAVAPI_engine_versions_get SAVAPI_extract_malware_names SAVAPI_free SAVAPI_get SAVAPI_get_dynamic_detect SAVAPI_get_fops SAVAPI_get_instance_pool SAVAPI_get_type SAVAPI_get_user_data SAVAPI_get_version SAVAPI_global_set SAVAPI_initialize SAVAPI_is_running SAVAPI_is_running_ex SAVAPI_register_callback SAVAPI_release_instance SAVAPI_reload_engine SAVAPI_reload_engine_ex SAVAPI_reset_instance SAVAPI_scan SAVAPI_send_signal SAVAPI_set SAVAPI_set_avpal_init_flags SAVAPI_set_avpal_inited SAVAPI_set_ex SAVAPI_set_fops SAVAPI_set_log_callback SAVAPI_set_quickload_init SAVAPI_set_user_data SAVAPI_simple_scan SAVAPI_uninitialize SAVAPI_unregister_callback SAVAPI_with_encoding_get STCHARToChar STCHARToString STCHARToTCHAR StringToSTCHAR TCHARToSTCHAR _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4 asc2bin bin2asc bin2hex hex2bin

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi.exe

IMPHASH b2c0c973d5f09d420286375ac5b4de47
SHA256 89a60761dcc3fc59a8a672c630f46a0d1e0626b04b5913c95a7a8505ed1e76fa
MD5 7a0231994dbcb4fa2eb0e7817e7a18ec
SHA1 0440be78bc953e2a47a963c756702148829ca352
SHA512 6b33ece73befbc1d53881418d23d3b8b132de07d5659df5044d9509a3fe091c27c4613d01c14ce5a3dd0ff8b21cdd1642409313d3d9239e92fb5d78bc4273ae0
SSDEEP 12288:fSKMPLjpGKVYy27/jB/4IuLMAQNKV5ft1JDHcFkouvmW97EDnw1Xak/Y58a0cSn2:rALjpGKVYL1l+Zt1JDH/PEDnw1Xar6nx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

87:b6:a1:5d:1e:1c:45:0f:7b:6f:f2:d1:00:3e:ea:30:9e:b0:ec:5c:b5:d0:ca:4e:69:b2:8b:f0:61:19:45:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

382555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\src\savapi.pdb

ws2_32

setsockopt getaddrinfo getservbyname htons htonl freeaddrinfo getnameinfo send recv inet_addr getsockname ioctlsocket ntohl socket shutdown select listen connect closesocket bind accept __WSAFDIsSet getpeername WSASend WSARecv WSAGetOverlappedResult sendto recvfrom ntohs WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

shlwapi

PathCanonicalizeW

kernel32

DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW CancelIo SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcessId GetTempPathW GetModuleFileNameW SetLastError CreateHardLinkW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW Sleep GetTickCount GetStdHandle GetConsoleScreenBufferInfo GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SetHandleInformation GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation ExpandEnvironmentStringsW GetCurrentProcess FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle ReadFile GetFileType GetFileTime ConnectNamedPipe SetFileAttributesW SetFileTime LocalFree SetStdHandle DeleteFileW SetFilePointer DeviceIoControl GetOverlappedResult MoveFileExW LockFile LockFileEx UnlockFile UnlockFileEx FlushFileBuffers PeekNamedPipe CreateFileA CreatePipe CreateNamedPipeA CreateDirectoryW FindNextFileW HeapSize SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA DuplicateHandle SwitchToThread GetCurrentThread TlsGetValue TlsSetValue GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree OpenFileMappingW GetEnvironmentVariableW SetEnvironmentVariableW CreateFileMappingA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess GetVersionExA GetModuleFileNameA LoadLibraryA UnhandledExceptionFilter CloseHandle CreateFileW SetConsoleCtrlHandler GetLastError SetUnhandledExceptionFilter IsProcessorFeaturePresent GetFullPathNameW WriteFile QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount RaiseException GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleMode ReadConsoleW ExitProcess GetCommandLineA GetConsoleCP HeapFree HeapAlloc CompareStringW LCMapStringW HeapReAlloc DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetStringTypeW GetProcessHeap SetConsoleMode ReadConsoleInputW GetFileSizeEx RemoveDirectoryW

shell32

CommandLineToArgvW

advapi32

CryptReleaseContext LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA PrivilegeCheck OpenThreadToken GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExA LookupAccountNameA LookupAccountSidA IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority EqualSid OpenProcessToken StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegOpenKeyExW RegSetValueExW RegDeleteKeyW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptAcquireContextA

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi_post.bat

SHA256 32b7a45aa617824e689117ff5cdb4641e15c8a3e44dd3d2c7e1a6b339668cb4e
MD5 beff803a30f96deaa30ccc67c1f1b8e2
SHA1 4a95e73d94fdd8de53d3b6cc202a58c676453499
SHA512 782db36522cc59b8f3b860501e85a680e002932ac9d3f46cb7a10da915c2d17c34f0f0c35991a7c35742c584e277712514f1ee66531aff8bac7241c5be63eee3
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi_pre.bat

SHA256 0a8e1189c0111047676f9615fba85b70738ea2d5f3e6323a35fbced61ece5523
MD5 fa64c737cb2e55539c0e94ad3da8502c
SHA1 7180342b8adbe3486a98f0716ba80b906e8a1e38
SHA512 596f0758df96f85f90700a237f8bfc5da2ef3332ff72cc9a9df26e307e5148dc2d23a589c9d9205af27b32ef771536f416847122b4a0d3d46c7d97fcf365ee39
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi_pretest.bat

SHA256 cde8920adab251a2aa003785ba61ab1e022b52e86904c6cdb6b41cc60a04160d
MD5 1a5095ba4345a2aab940d72da9b7e076
SHA1 e99d84ddb548804d0fdaa1dc2c3b61ab73fa387d
SHA512 19cfc2ed97c161533907afd02aa00ba8eca58e26f31cee3a49675e8aea5cb4a4e5167fde4edef69fa228f41bb24540aed8d77f24c9c6187ba0147bace288b7bf
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi_restart.exe

IMPHASH bb514035bec9282b23f2c63992fa7c65
SHA256 5f661a09f517aaf8344f43864678e9b7a4c63574e9ec070ca749ad79e9c96fe5
MD5 f7853307bfef49d66a8cdf556ab6b2e1
SHA1 66ed9129b795ebda8c4e0107c75a6e8f469572b9
SHA512 0d041fcde35c8fddbfc9c186cbed22e2db1fa2634fb02c7a4bc8e1ea4136f2c8322df263c3b887bd96fe902767a9fed92ed0a0e6f1309c2061854c88b66428c5
SSDEEP 3072:a59MHkUtVPvBLBXjKVqxzMM4iGBiysOBC2cTtjpTebk8PC+1zJHaGVYRw3gn:MWVBBmqdghBitF46JR22
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

7a:2f:f3:37:83:28:30:52:5c:5f:b7:36:af:22:80:97:87:59:4c:2a:a5:e8:10:ed:42:db:e7:ee:17:10:21:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

8052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\utils\forupdater\savapi_restart\savapi_restart.pdb

kernel32

WriteConsoleW GetTickCount Sleep FormatMessageW LocalFree CreateProcessW GetExitCodeProcess WaitForSingleObject GetLastError CloseHandle CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc DecodePointer

advapi32

StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapi_stub.exe

IMPHASH 03f4339e9d4921ee94b76cfcc6539613
SHA256 1d87f3eb55e3b8a241e5790c2c64c41d1e74833764e190b0b65b7f66b461a34c
MD5 7e26af01272bb1f224494431ebb99e8d
SHA1 0b6e1dc5eb76f6d8f66669adf3d635c40610c56d
SHA512 3964e759e1335597180ce8a1d37869a1d8ed59f1075129fa4e246e782161d3798d4d887ede4b44c4fe70e3938d0f0594357a691981e3c45fc2291a018486c8cb
SSDEEP 6144:QbgJlyvV0gIHo7c7L5oLkQ7Wp39WDFp3p1aQ2i8PIQ8ol8EhErFjEmrtHs4+sDsj:QbgJliygIHoXTe9WD73p1aQ2i8PIaljX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

f5:33:4a:05:15:5d:6c:fb:03:cb:4e:a9:e9:69:7c:23:bc:86:e9:2b:a9:fd:9c:fe:b7:40:ee:0c:89:4b:49:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

1

Major OS version

6

Entry point

127520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\utils\forupdater\savapi_stub\savapi_stub.pdb

ws2_32

getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername gethostbyname socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept ntohl WSAGetLastError WSACleanup WSAStartup gethostname

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW RaiseException LoadLibraryExW GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetLastError GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW GetStdHandle CloseHandle GetHandleInformation SetHandleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW ExitProcess SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW TryEnterCriticalSection SetEvent ReleaseMutex CreateMutexA CreateEventA FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapSize GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent TerminateProcess CreateFileA CreatePipe CreateNamedPipeA GetVersionExA GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer GetConsoleCP GetConsoleMode FindFirstFileExW GetStringTypeW GetProcessHeap SetFilePointerEx SetFileAttributesW SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/savapiclient.dll

IMPHASH 7b047355bb875c04977e75246edcb6d0
SHA256 bf65f1dc80d106f33e0ab96e40aca2ee290b2c87096878e0f767e9729c48d613
MD5 3e9ebcd9bb281829e8dde4e591536699
SHA1 62b66e57e4e63bd657eb7a17a4c846b57d378d9d
SHA512 93b6b2c19cbd51d0a2b51f35d980decad84f696e438eaf7710662555ccdd5f5c1e05ae2078c475b6a350e94ab7b2b38d9814209635b56eb30581e0aa080c1238
SSDEEP 6144:t4GQ4ev2NeV3yKN1fnG8YzpZryn/2k6WumOc4a5xbzjvLSsHoDlE+A7cTVqxd0f4:CGQ4ev2NeJyKN1fnG8QS/2kjzbzjvfHR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

34:f5:83:da:45:e1:a5:58:fa:8f:12:5a:bf:d6:be:15:66:c3:33:73:20:77:50:52:9c:c0:f5:d5:90:b1:42:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

1

Major OS version

6

Entry point

176244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\libsavapi\client\libsavapiclient.pdb

ws2_32

recv inet_addr setsockopt send freeaddrinfo getaddrinfo getservbyname ntohl htons htonl getsockname getpeername ioctlsocket getnameinfo WSASend WSARecv WSAGetOverlappedResult sendto recvfrom socket shutdown select ntohs listen connect closesocket bind accept __WSAFDIsSet WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

advapi32

GetNamedSecurityInfoA RegisterEventSourceW CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW DeregisterEventSource GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW

kernel32

GetModuleHandleExW RaiseException LoadLibraryExW FreeLibrary WriteConsoleW RtlUnwind InterlockedFlushSList GetModuleHandleW GetStartupInfoW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW DecodePointer IsValidCodePage GetCPInfo SetEnvironmentVariableW GetConsoleCP GetConsoleMode FindFirstFileExW FindNextFileW GetCommandLineA GetProcessHeap GetStringTypeW SetFilePointerEx InitializeCriticalSectionAndSpinCount GetOverlappedResult SetLastError CloseHandle GetLastError GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetHandleInformation WaitForSingleObject CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA GetCurrentProcess GetCurrentThread OpenFileMappingW GetStdHandle SetStdHandle CreateFileW DeleteFileW GetFileInformationByHandle SetFilePointer DeviceIoControl HeapSize CancelIo MoveFileExW CreateHardLinkW FlushFileBuffers ReadFile WriteFile PeekNamedPipe GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA ReleaseSemaphore CreateSemaphoreA DuplicateHandle SwitchToThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess CreateFileA GetVersionExA GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA IsDebuggerPresent InitializeSListHead QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

shell32

CommandLineToArgvW

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/scew.dll

IMPHASH dc673cc809e3fae6159a3903886c9d52
SHA256 cbaaaa7da4d8eea49107009be8c1b63cec951eaeb942f360634c6176dde06e40
MD5 692c01413f439a7ee73d601e48f4e4fd
SHA1 87743f7873ce8e74c994cc2cd8d90ef6f62cc959
SHA512 037772daf3934f20ce3a7a2d93cb7f3d5ef7e3a1686b4b62ce7444fea172e74fcd9bbd94e2ddc7ffb96480b78835e52d6c5645469498e09abbfae62d38911cba
SSDEEP 6144:Kiu1bm4UTuNoo65B8riGD4VhkdGGdaDrd:Kiu1bm4c7b8rvFdGGdaDp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ee:7f:5b:c6:29:00:77:cb:34:23:15:9b:5a:ec:cf:d3:ee:3f:28:e9:a0:e0:f2:c4:9c:41:d0:30:37:3c:2a:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 20, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

1

Major OS version

6

Entry point

104419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\xybspddn\common\scew\scew.pdb

XML_Parse scew_attribute_compare scew_attribute_copy scew_attribute_create scew_attribute_free scew_attribute_name scew_attribute_parent scew_attribute_set_name scew_attribute_set_value scew_attribute_value scew_element_add scew_element_add_attribute scew_element_add_attribute_pair scew_element_add_element scew_element_add_pair scew_element_attribute_by_index scew_element_attribute_by_name scew_element_attribute_count scew_element_attributes scew_element_by_index scew_element_by_name scew_element_children scew_element_compare scew_element_contents scew_element_copy scew_element_count scew_element_create scew_element_delete_all scew_element_delete_all_by_name scew_element_delete_attribute scew_element_delete_attribute_all scew_element_delete_attribute_by_index scew_element_delete_attribute_by_name scew_element_delete_by_index scew_element_delete_by_name scew_element_detach scew_element_free scew_element_free_contents scew_element_list_by_name scew_element_name scew_element_parent scew_element_set_contents scew_element_set_name scew_error_code scew_error_expat_code scew_error_expat_column scew_error_expat_line scew_error_expat_string scew_error_string scew_isempty scew_list_append scew_list_create scew_list_data scew_list_delete scew_list_delete_item scew_list_find scew_list_find_custom scew_list_first scew_list_foreach scew_list_free scew_list_index scew_list_last scew_list_next scew_list_prepend scew_list_previous scew_list_size scew_parser_create scew_parser_expat scew_parser_free scew_parser_ignore_whitespaces scew_parser_load scew_parser_load_stream scew_parser_namespace_create scew_parser_reset scew_parser_set_element_hook scew_parser_set_tree_hook scew_printer_create scew_printer_free scew_printer_print_attribute scew_printer_print_element scew_printer_print_element_attributes scew_printer_print_element_children scew_printer_print_tree scew_printer_set_indentation scew_printer_set_indented scew_printer_set_writer scew_reader_buffer_create scew_reader_close scew_reader_create scew_reader_data scew_reader_end scew_reader_error scew_reader_file_create scew_reader_fp_create scew_reader_free scew_reader_read scew_strcmp scew_strdup scew_strescape scew_strtrim scew_tree_compare scew_tree_copy scew_tree_create scew_tree_free scew_tree_root scew_tree_set_root scew_tree_set_root_element scew_tree_set_xml_encoding scew_tree_set_xml_preamble scew_tree_set_xml_standalone scew_tree_set_xml_version scew_tree_xml_encoding scew_tree_xml_preamble scew_tree_xml_standalone scew_tree_xml_version scew_writer_buffer_create scew_writer_close scew_writer_create scew_writer_data scew_writer_end scew_writer_error scew_writer_file_create scew_writer_fp_create scew_writer_free scew_writer_write

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/vdfupd.dll

IMPHASH 7aae4018f59ff65fecb5069da6ba2ecb
SHA256 7b92f32549f873f1849792805cb4bbff2125444383879c244100fd1ca9fd7777
MD5 ed74b5c4230c87ce692df2fbe4c423dc
SHA1 b6a9e2b87d64de18c4c17594954549661fd3900b
SHA512 352458dacf49deaea9f081f50638c898a8044e5fe8c75eed87a5c064d6b04b9eb050f64c7b57d98920192e2bc5bec38096df7554586485140256b230cff97648
SSDEEP 1536:+/L4zK8Oc8MCjx7anrV/pmNI0FFjGULRkTDCouNAotnGp1iP13hIsb:U4z58H70OFFjGULOSAotGSP8sb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a6:31:71:a7:52:6c:e6:c3:28:0b:26:d5:1e:6c:02:fc:95:90:bb:63:cd:43:30:24:d8:4b:de:61:19:9a:b6:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jun 12, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b4:c6:c9:6d:ab:0e:11:6d:51:c4:cb:9b:d2:15:eb:9c:71:2e:27:45

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jun 12, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

18753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetFilePointer WriteFile CreateFileW CloseHandle GetFileSize ReadFile HeapAlloc HeapFree FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW SetFileAttributesW GetFileAttributesW DeleteFileW MoveFileW GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetProcAddress GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA GetFullPathNameW GetCurrentDirectoryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection RtlUnwind LoadLibraryA GetTimeZoneInformation GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar LCMapStringA LCMapStringW HeapSize GetLocaleInfoA GetDriveTypeA GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA CreateFileA

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/xvdfmerge.dll

IMPHASH 7ea29dfb7902eaf1812724d972d2935e
SHA256 ae345a17da1c8923bd89c1cf4322990e5e3b520ff2f0538c01f72f57fecf74a5
MD5 3da205f3e6f1ace3b4f471c3a66f8f20
SHA1 2dadac5b2a727702ad75fd4785d32415f968857d
SHA512 84e31019779c649bf5aaec23a9710ab2b624892efe689a32497c62739b12ba3b78712f5e3a29829be424b558a19bbca0e69b7e78fbc56433fa05a90edda383f8
SSDEEP 6144:cLfwbG31EgrKlbjch35VLFIYid/TGdDZjMlt9wKtgl5jR4wWbKQIMOm9n6DFsIoG:cLfwk1EYKlbUBI5dGdDZ8t+Fl5jR4wWU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

42:8a:b0:da:20:3e:92:84:5c:27:91:8c:69:21:2c:fd:43:0c:f1:12:de:e4:17:5e:05:b5:1f:a6:2e:6f:0d:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

146978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\common\xvdf_merge\xvdfmerge.pdb

ws2_32

getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept gethostbyname ntohl WSAGetLastError WSACleanup WSAStartup gethostname

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW RaiseException InitializeCriticalSectionAndSpinCount GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetLastError GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile SetFilePointer WriteFile SetFilePointerEx GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW HeapSize SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent GetHandleInformation SetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess FormatMessageA CreateFileA GetVersionExA GetModuleFileNameA LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA RtlUnwind InterlockedFlushSList GetConsoleMode ReadConsoleW ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer GetConsoleCP FindFirstFileExW GetCommandLineA GetProcessHeap GetStringTypeW PeekNamedPipe GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

$PLUGINSDIR/AccessControl.dll

IMPHASH b79de4e8687b3fce7173ec8dc917f685
SHA256 d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d
MD5 9e7d36edcc188e166dee9552017ac94f
SHA1 0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a
SHA512 92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783
SSDEEP 192:y26NwF1FF8GqdxASZlSOnNGGPCqLXUdadWo2FfTCWWqDsYjGI5hBslft8gWNPjQo:I+8vwSZlgaJ3/4/4Q/bN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/INetC.dll

IMPHASH 8e4c63f70f7cc6490634d743e795c93e
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateThread CreateThread LocalAlloc lstrcpyA WaitForSingleObject MulDiv ReadFile GetModuleHandleA SleepEx lstrcatA GetTickCount CreateFileA GetFileSize DeleteFileA lstrcmpA lstrcmpiA SetFilePointer WriteFile GetProcAddress CloseHandle lstrlenA LoadLibraryA lstrcpynA LocalFree GlobalAlloc GlobalFree GetLastError WideCharToMultiByte

user32

LoadIconA SystemParametersInfoA GetWindowLongA GetParent MessageBoxA DispatchMessageA SetWindowLongA KillTimer PostMessageA IsWindow GetWindowTextA ShowWindow SendDlgItemMessageA TranslateMessage IsDialogMessageA CreateDialogParamA SetDlgItemTextA GetWindowRect SetWindowPos SetTimer SendMessageA RedrawWindow GetClientRect EnableWindow FindWindowExA UpdateWindow GetMessageA GetDlgItem wsprintfA DestroyWindow SetWindowTextA IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA InternetQueryOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile FtpOpenFileA InternetSetFilePointer HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetGetLastResponseInfoA InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetErrorDlg

$PLUGINSDIR/SysRestore.dll

IMPHASH a4814f13f35bacb060420cabbf9e8154
SHA256 c5e335bd19fa798f120287fe3ed920296f899223942fd6b987585a765f0adec2
MD5 da046184a8d7269a0e138b0b0b9b2eb5
SHA1 d9bc5ea397857e17a86f80df1e50615eb6859044
SHA512 9ee6965ac931839a5d61b4ed64bb3bbf434dfd10ff086c38a998ec6714018b5491da7e5c29e4f7dd7fd4a93b2f285869b20f88b4b0194c9ba7824ff7c9f03c80
SSDEEP 48:S5SjUZmikqTB1By5B6UBQzcszn3x3YlE41tq9/Iye:ASOz5ns4UeI2B3Z41tqlc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 123918b9bc59785fa8ff2142b20d537cd1b09848ba5d88e201e70510b74be295
MD5 c493cb5a2e37620ee28be3665a29e84b
SHA1 c29d5d793953871935bc2a253bcedf44b9d7565f
SHA512 21e09e6092bad24b7a049651a1874b7e7e4b12b3ee60d2199e6852f4540d7e5b1c46d64ab591460d58f3f2227d35de6991470795f7ecaeda662b8f03c7897c54
SSDEEP 768:xkT6kcDk+kTkAktSkBhUkRkG3SkBkfHkck21k2qkGakUttkTkcktsk2k2Sk2aFkp:3VMcSF3piU0fQQRMAJLXyTeICJw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 42f0da3301c3739d99de30e1a58ff39baed543c3e0447bce9c15f8a95e8b3090
MD5 d8d29ac4330a252c15fb48d9758aa378
SHA1 21ced4f2220106e592b2edc6ef5756f26c12f588
SHA512 4f4ca9d3653a4587c6080a4e8827dbf274defade44cd9a7432c94828ee19dc89e3bec00eada5650db0b0f22bcb28bfe459378d2b19cc90d9fabce19a1a5b44a7
SSDEEP 768:FUw/kctENM58S4uXr/y+74RFhK/F0xZ+GdGTk:qne4ubT74RFhoF0xZ+GdIk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

API-MS-Win-core-xstate-l2-1-0.dll

SHA256 85baa715daee8d40428a8587a3d331f64146e3bcf18571a50403ffa63d56e4c7
MD5 a76f950525a01b00be276c6d4a991e9c
SHA1 7a5661baaa98889803cf86ee87bfbf9bc4c50bd5
SHA512 aa62da3bf73f4faacdf46e08e58b058969c1d2351ded5c1662c0097e00ff8d454f3c2af165309a37ab6f17bc6d116eb402e26493c15c18e0970f19d313832a6f
SSDEEP 192:bcf5b+W1hWmWULwu0Sc2HnhWgN7aQWZDLhMzqnajKsFY6I:bcf5b+W1hW4D/HRN7GDVslGsFY1
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-xstate-l2-1-0.pdb

Accessibility.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 57dcc709a560b65d9ebfc17065ee6f378a76ca4e766f1fd06bc24f187ded539e
MD5 3b9e529f105c07167d06027648fcb505
SHA1 2889302f482c3a2e52bc57f3a07e43cd5781cc62
SHA512 596b812ef63f0f3931a6413f9ca3a28cd018ca4eb536bf43743ac991ec3644d42e39683a40f84f9642132a8893a535dcc55e931af7297aebc07ac0ebd3c2368a
SSDEEP 192:mN1WRFlDWlolDWlIJh2ICtMBYY5IQY2NLnG63etbrWu/W:S1UlqlolqlIWGPI2LGptvWu/W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e898eab39550c7eae11f5f626a420b5faf62b2905fe84d3d00260f6ee814e8e9
MD5 dbde15bd0511fac2e3c9aaaf558b3d6f
SHA1 ca10cf499fa6f282e02692c661829131d776eaaa
SHA512 04c32d165c91b1d948c306ac431a6573e000206a06be1f6e41812012a1fbfb207a8da31ca6a0536fac27fa38a2957c78b60af8dc973c5e72272c69d59e87497f
SSDEEP 12288:BPDhk72AyO5T11cJxSKTZcM4CJ2FLI+nN/Uu4b45YIKApGOEJq7qLBqewB:UyAy8Q7TJ2FL7nN/UuPxT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7c:86:ac:bc:ac:4b:fc:85:c7:be:c0:47:fe:b3:0a:92:ce:52:75:29:08:18:a8:c0:ea:ba:f9:2c:df:af:f3:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

1045838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BouncyCastle.Crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e7c9e901e6d927778938d3ee5d183dce495d6b6eb2a89242a700afe25d921cf6
MD5 9d34c40df4c87e378bdb0a3ebd36bfc2
SHA1 5c110a3a90e792270b44e3e3f6cf31bdd9020295
SHA512 51eea2113ac5acfd553b3e0b35390c38323218de55fd5b8abc8cf44bd0445df84eaf9349b52491737aa826ce76cfc2fe5eb5aaa60413cf376b4479ff21a19339
SSDEEP 49152:2brsw7nZ8pRbkwLdPkSAu5LdPkSAu5LdPkSAu5LdPkzkHi2LdPkSAu5LdPkSAu51:U8pRbx4kg1qA4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2369022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Branding.Desktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f7ee68ca16d50a06ca2e73a36957803ae276b71dca59a662fba9821a951ab306
MD5 eaa51673d63c12f5b928c42da34e03ad
SHA1 e33fd00a2729830d5acd77bd62008fa0f04410de
SHA512 1a916d64820aba829e22f17409c3bf5fae1bd02dfad5148d0eaa54a43efc2aa8268297128d80bd75cc704c2cb7bc0bcf2214caa459b6b002717012c00ddd2429
SSDEEP 384:oanjMEWG4aIr+omiaV4E1eZzHoNZsHLcP+th0:RnjM31aISTiaV4E1CVG+th0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

bc:3f:3c:14:06:64:db:ce:14:a6:21:51:0b:af:e4:56:8e:9f:6c:dc:b3:99:2e:9a:e0:fb:5f:7c:68:79:39:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

16158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47_cor3.dll

IMPHASH 131726669bc1e34b495edb4198d0aca3
SHA256 4a62063a3c7efcf0faa3800a93fcd26728ef753d3b83bc919c12cebfb582f0f0
MD5 cd8a3be4d5871171fd0b107132d97be8
SHA1 415258c10477a49d0c046a12123ff7abe957612e
SHA512 4acb09bf0c4c8e704fa6e2a20d98c5ff17ef77fc30b8c86b975f5aff8d6448c6e521588106b7810a2c0ab4c5af63519821da590830b37cf2faec380c8ae9e2af
SSDEEP 49152:grToHAsisjBFjJMLhHELxJm8ZU8W/GKa5Z535TMpiUAFzxkF+cD1gbqCG7jHbOkV:g2ZOb8W/GVhUAFzxSyNFy9AQ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:6e:b3:7f:16:6d:b5:27:89:b4:d6:e4:65:fa:7d:25:22:3c:ad:f0:45:d0:d5:cf:cc:73:e8:b8:19:f8:46:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

2809424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47.pdb

api-ms-win-crt-string-l1-1-0

wcsncmp strnlen __isascii strncmp memset

api-ms-win-crt-math-l1-1-0

_finite _isnan

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _controlfp _clearfp

api-ms-win-crt-private-l1-1-0

_o__atoi64 _o__callnewh _o__cexit _o__chsize_s _o__CIacos _o__CIasin _o__CIatan _o__CIatan2 _o__CIcos _o__CIcosh _o__CIexp _o__CIfmod _o__CIlog _o__CIpow _o__CIsin _o__CIsinh _o__CIsqrt _o__CItan _o__CItanh _o__close _o__configure_narrow_argv _o__crt_atexit _o__errno _o__execute_onexit_table _o__filelengthi64 _o__fpclass _o__get_osfhandle _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__lseeki64 _o__mbscmp _o__mbstrlen _o__memicmp _o__open_osfhandle _o__purecall _o__read _o__register_onexit_function _o__seh_filter_dll _o__strdup _o__stricmp _o__strnicmp _o__strtoui64 _o__wcsdup _o__wcsicmp _o__wcsnicmp _o__wfsopen _o__wfullpath _o__wgetenv _o__wmakepath_s _o__write _o__wsopen_s _o__wsplitpath_s _o__wtoi _o_atof _o_atoi _o_bsearch _o_calloc _o_ceil _o_fclose _o_floor _o_fread _o_free _o_fseek _o_ftell _o_getenv _o_isalnum _o_isalpha _o_isdigit _o_isspace _o_isxdigit _o_malloc _o_modf _o_qsort _o_setlocale _o_strcat_s _o_strcpy_s _o_strncpy_s _o_strtod _o_strtoul _o_terminate _o_tolower _o_toupper _o_towlower _o_wcscat_s _o_wcscpy_s _o_wcsncat_s _o_wcsncpy_s _o_wcstoul strrchr strchr _except_handler4_common _o___stdio_common_vswprintf_s _o___stdio_common_vswprintf _o___stdio_common_vsscanf _o___stdio_common_vsprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsnwprintf_s _o___stdio_common_vsnprintf_s _o___std_type_info_destroy_list memcpy _CxxThrowException memmove strstr __unDName wcschr wcsrchr __CxxFrameHandler3

kernel32

FlushViewOfFile MapViewOfFileEx SetFilePointer CreateFileA InitializeCriticalSectionAndSpinCount ExpandEnvironmentStringsW DeviceIoControl SetFilePointerEx SetEndOfFile GetFileType DeleteFileW SetFileAttributesW GetFileAttributesW LCMapStringW SetLastError UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize SetEvent GetModuleFileNameA ResetEvent WaitForSingleObjectEx CreateEventW LocalFree LocalAlloc LoadLibraryExW lstrcmpiA GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetFullPathNameA GetFullPathNameW TlsFree TlsGetValue HeapDestroy TlsSetValue TlsAlloc Sleep FreeLibrary CloseHandle ReadFile GetFileSizeEx GetLastError CreateFileW GetSystemInfo VirtualAlloc VirtualFree WriteFile HeapFree GetProcessHeap HeapAlloc OutputDebugStringA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte MultiByteToWideChar DisableThreadLibraryCalls HeapCreate GetProcAddress GetEnvironmentVariableA

advapi32

CryptDestroyHash RegEnumKeyExA CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext RegQueryValueExA CryptAcquireContextW RegCloseKey RegOpenKeyExW RegQueryValueExW RegOpenKeyExA

api-ms-win-crt-time-l1-1-0

_time32

rpcrt4

UuidCreate

DirectWriteForwarder.dll

SHA256 0a65bd323b999ba7403602e1f4d7b31d5734410bc9d13197a7af45933dcfbdfc
MD5 fecf842db8348dc99657c177771a6ccf
SHA1 548b1f39fd35caec51cc38ed51a66576a5ada947
SHA512 df267de977a31291001e0caf9b12ccdb2ecd6659f3ad81ed0c3cf3f7ec634c0366f80d8b3d41a849a19d507c9a66b0dae2f0bdce51a162cfc5e131df08293414
SSDEEP 6144:hD52yN514hfoiBXpG+6vl5fN8QWBF41knF3eVdv7eDGKwHrDOZ7a:hD7NgXXpG+6vJ8QWAwF3EC6KwHrm7a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

eb:dd:4f:a4:7c:2b:e9:81:b5:1c:cd:99:54:1a:78:62:7a:71:64:b4:ae:8d:59:8c:01:95:8d:23:4e:4d:f5:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DirectWriteForwarder.ni.pdb D:\workspace\_work\1\s\artifacts\bin\DirectWriteForwarder\Release\netcoreapp3.1\DirectWriteForwarder.pdb

DotNetZip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28d76d7ac169c5b71cca4e3073226f885a2f06720413a11e8db9b7fc08359462
MD5 6a8c8771bd399dd468595bab186c3e88
SHA1 df56e2573396ad8da5998c6aaf89c508f2060a85
SHA512 3e7a0e3b0b182e97e44504c4aa511065ea910a88e88ea849a5977f64dfd64aca6008815a6307e1d82a706b66811ddc5a1234b37c95a80e1a01feaa8b8fdc3d74
SSDEEP 3072:QXsFvbsM5ecgKXnukd2sn8Dhm58yEJEYkbQcHPoOFqvAvIMqUo1SccvdH8UfrxA6:tmE7gX22sGhs2JcjpIN9+8UfrOsWs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

244462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Engine.Win.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 60a9c346c380d985be18bc1a702284d92d975366c9f4e87148e6d1a5baedc9ef
MD5 cbdc7dbee3576e26f277e743ed3e621e
SHA1 38531daf24e88b26cb54da848bcd68fae97b6b2b
SHA512 883f950b31d34d223c8f67613f2bc8d9654ad00419a6fa44f56cc794ca5159ca733342f82b884b0a1de22de08d40223b0596cffeecdfe2e90979ffcf8ee783c0
SSDEEP 12288:Hrr4UkBmuoZz7BjpVedcSVCXyTfKrOQm/+dzdzKPq:LcUWeZz7BPwQCiu+dzd+i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9c:2a:04:fd:66:cd:c8:cc:47:41:6a:9b:55:30:17:91:62:a9:50:fd:34:7c:f0:1b:3c:99:7f:2e:99:e6:b4:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

839854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.SqlServer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4c39d8f0fb669e6e337c5f3138f6171b0905cf875a92b0e3253f33955b87b55
MD5 4010a41e4730439275c00c358550393f
SHA1 572a2fb0526523e3669a53264fc51adac70c4ad8
SHA512 5a554c85ea0222c9d96ebe24b2b0730c3974c59389e2fd0672ccd2c99f78b937bc4529151a24cc68357a308d3e9990f09eb854b05466538c422847d9849f84a9
SSDEEP 6144:frmoela3kPuG2p6GeqDmjaVmnSmr/u65oPWtduB6yHtYw:fvelMwu65oqs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

584878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7f8427f0d039ba33d7b414604baec4b62d6dfef9e1f5c078d403e7a04e8dd9b
MD5 ab3c40670c848ac52f32221a7976cedb
SHA1 20a05ff58f34ae9c6b046169e42db3b68b805fb2
SHA512 8e97b78a6ae9590e84b0d06f5a37586893c4c099a99aad2c50a6ea49ea1aae2acd07501d4e6af905a2263cd2a14f743746e18059204d8dff9b19439000cba705
SSDEEP 24576:nhI7iceqhqPP3COtQmJnfylfF6RTazewudnOCJNBZ3tc1D1Q5UGLG16pd4XtwZou:IOm2y5Ea8c1p2fa+wvHo8IryABzw1k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4936030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GUI.Win.deps.json

SHA256 6a4c8e0e86765a63c7eebd2651045d95a9db4088286b3bb55640bf746208a780
MD5 a6204caea03ad60c1a2c75de89bb7424
SHA1 b06364709a29531a94232e1f9247309a01a89e6f
SHA512 67162b5a84ed0f032e3bdd33ee637540db3492dda6eef79d4e0b02e1a2ecb4a0f2dbd45a43b852d553c45a0313858301c2adf7cdd04a4c446250099f3ac27625
SSDEEP 3072:iLGPgBS/Rt1Y9Im07R1ARkgT9uextHZqeajpXTwg09B:i4S
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

GUI.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6caead92fb0ab737fe4ca17adf4d32c681a2015a9954b89dd59febeba29b0ea0
MD5 9fa0efb3a457a5359a82f3d8026a5da9
SHA1 6c727c2d4b55d16eea33704e0fc952f5407cd738
SHA512 bf7dc3332c1dab28929d6b9e37dfd3c7011b4e7f575cbcdcea3b5d4ea5725317402dc2bf21936cbf174374ec6893c25a8d21d56319267e62a422a04fe7c4391e
SSDEEP 24576:YFQ5i/qutKMwf6rJt/YLv9utaigBDTThOFRkb/:0R/OqLz28kr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

aa:ec:b2:f0:22:26:d2:1d:67:5e:ce:3c:03:25:28:66:99:a4:40:3e:0f:c3:29:a4:96:6f:b6:7c:43:20:d6:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

1814382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GUI.Win.runtimeconfig.json

SHA256 dc4b3413e739405445afd837bf5bcfbae96c1172f60f2c397a80b3f7dad8c99e
MD5 fcee6bbea41d26598a182ee769296702
SHA1 694f9ac9bfce76c821bccf8ae3dd0e99be5f6180
SHA512 b2b19ccefd60733b9f13ef1046ca0f825c3603afe6ab376157dc287a06bd8081f9dc067a828db426b7b92038181aa3af6746272330284ecdf80984ec0a38d1f1
MD5 SHA1 SHA512

NSIS installer

installer

HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f35cffed9992cf7af5710d8f48dd1ba55b9c16211746e16fa474277ec5e5e1a7
MD5 2ccdd5e34604c7b55df78be8d1977135
SHA1 785dfda116c774afa7270713b1308ad1d8c2d200
SHA512 89947874a3c167b6e1202f338ef084baca5c7f954205f65ecaa0b284e74618058b3b1db0fa8d45fd558746eb278feeedd98320c8b79cd67049af244f511e7049
SSDEEP 3072:imEWPCpf49WhHIDkWMeqoAomvoPdk/kdGYp9i5R3N:Yf49WMkso7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

166014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Manifest/chrome-manifest.json

SHA256 542db227dad2ca52cbfb3bbd15a56a319870e0f86a819dda8c3d2931644a8120
MD5 21b2a99408f622ba3de5751c6042f794
SHA1 b661b1de6aac5992d47d9119c5bc30327466660a
SHA512 7590e9f4fd15acd234598d17eb60a79804c22db4e393240d164757dd68606e29f11e030c5df4824fef04e7677f91a92c8bceb8e4ac73184f239dd845f44ccce4
MD5 SHA1 SHA512

NSIS installer

installer

Manifest/edge-manifest.json

SHA256 8a96c6c31ed88f6c7b28a28dc965b3776edb3e7c5ba857aa203b33e39efb853b
MD5 71a0a11da12e252bd32dd5b467295ece
SHA1 d58458ee3a4612cb72804961e981176242394dd7
SHA512 a1c0238cb9c5c2c95a0f92c8bc40c9f6f61046a381d9391245fca3cfa11eed1d6f7b2176b2d52ef1dc9f6b6fed72618b363f11096c9cdc811f1bebc30e778416
MD5 SHA1 SHA512

NSIS installer

installer

Manifest/firefox-manifest.json

SHA256 17e6cc438c28f43b3935d1747b767a4a0e518adba95a56aa7918dcb92d8af4be
MD5 cd6fbf69675912c8fb36a977e189514a
SHA1 6dc5f321251160ad77f415f5f3ac6ceef0e2044a
SHA512 0ead4652e686e8985ab8ea52a2958cdd59078807cbba2b6e27f1b10dfd9a2e7c05eee3a3b64d11b16b03e8fbe22e7c0f32fdc0b99a057d6f0dc5c5e94757bc55
MD5 SHA1 SHA512

NSIS installer

installer

Microsoft.AppCenter.Analytics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac8b2f3785163b38c4473f1aa25616a4616e2fbb29332fe3dd8da9574fc3c4cf
MD5 d4041b4e6cef641e52922aae24358e67
SHA1 03cd00c2094e6747b0bc489f1927d29dae39b5ea
SHA512 728dcee4a9e3909f760edbd6a6e582c6c40162f37cf0c5e61bb092679ef91e47e8e5bdba468c40f24010ae795f6e277ff1c60b9e46bee2dbc94b3d9c6491570a
SSDEEP 384:FHusqPUYyBiwwu9sXZsQb+Jx4veT6pzBcwyWUVMW:FOsqsYb9w7UBcH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.Crashes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1ac20df009a8879ff946388741b781b37f8209ac93260ff8a00573376def08be
MD5 389e880efe79f750488feed7fa52b1d2
SHA1 b0a58209ddd87d4ec1240bc1b556889850965148
SHA512 ce378858dd67c8ff7972036db1b558603c0c7bf74b82c0c965fcd039138be3eee08fb729b879a1c66b41d8fab7c70c0a9ad1c8e5c9490c4967cec87b2f62b436
SSDEEP 768:qs8Fis/HebQPbM9z9iDk+gGCHeHGoSMwdevPf:qr1bMvHXlemtde3f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9fac510c89ccb69d22f8e62c9f38bd9fe20d596501b1b91ead0bed33f50adb7d
MD5 984fbddfe9fba183394934dbd94b2be9
SHA1 181e083ebfbfd2f9f41051b30db2e363be5316b3
SHA512 f37f46ca3ce3032c839f21e826b72e91f73a861cb64104da60ea498c9a86e534aa1ef67fb9163cbeebe2a12b19535c2e4cf9bb648e201e35a529d2530c68e461
SSDEEP 3072:O/6mN7KWjKL7gHdJWRYhvbiJVIAQlHvIRQ0OzbXq:cN7PjKL7gHdJWRYe5UHv3ZT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

138174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6dab77334478a91094512816f7da693722f7f43184123071cec8a398ad0bbfb4
MD5 83e5467802ba4c793aae6691375a7a14
SHA1 5ec699fcd040bd327ae87696756c17f283738e37
SHA512 495f37b705a6cf4e30a8240f51b641a8db19aaa13c30ff2dca4a835065d955b1c86d37f10d2ba0618be7af71563aae62c0618176d97f64f428fd6d8341c11df0
SSDEEP 6144:ZMsCfqudVKjZSkSNw1oxu0LhdkjVsZBwRnIfPk9eG3u9yHcohlz:esCfidSkSNw1otkcG3u9yHT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

299150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.dll

IMPHASH 2750e561997e3d2f8e185972112eba29
SHA256 f21da9fb831ac943736135b6ee109a4b352511b8d6c07cb03c66b61996d1ddc9
MD5 4ff7094e3edfda47ced912012044296b
SHA1 c6f3c9d81713687dc3820d8cabf14c2a32208d27
SHA512 372867bbae96c51ee11b413f552a67a53992b16dbfa44105381db3813e3c2f9a3dc9d16fc6bd6366514d4e1b4bf1eeccce5261bc3df837bf3e3eb5a04446c551
SSDEEP 24576:7Xg0Ff/wSOM0TJuCD0Kbyk3dIf//LXpWhIHWLRDAcc17QXk0:7HHFRKbhdIf/TcIIhk/0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 28, 2017

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 2, 2017 - Jan 2, 2019

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

256480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.pdb

kernel32

GetLastError FreeLibrary WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualQuery VirtualProtect MapViewOfFileEx GetFileSizeEx GetFullPathNameW ExpandEnvironmentStringsW DeviceIoControl WriteFile SetFilePointerEx SetEndOfFile ReadFile GetFileType DeleteFileW VirtualFree VirtualAlloc WideCharToMultiByte SetFileAttributesW GetFileAttributesW MapViewOfFile CreateFileMappingW GetFileSize CreateFileW UnmapViewOfFile CloseHandle MultiByteToWideChar GetSystemInfo DisableThreadLibraryCalls GetTickCount GetEnvironmentVariableW LCMapStringW FormatMessageW LocalFree RaiseException LoadLibraryExW GetProcAddress TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError InterlockedFlushSList RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter LocalAlloc GetCurrentThreadId Sleep LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateEventW

ole32

CoTaskMemAlloc CoTaskMemFree

api-ms-win-crt-heap-l1-1-0

_calloc_base _callnewh _free_base free malloc calloc

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-string-l1-1-0

wcsncmp wcscpy_s _wcsdup wcscat_s _wcsicmp _wcsnicmp strcat_s _stricmp strncpy_s towlower wcsncat_s strcpy_s strncmp wcsncpy_s _memicmp

api-ms-win-crt-runtime-l1-1-0

_initterm _errno _crt_atexit _cexit abort __doserrno _execute_onexit_table _initterm_e _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo _seh_filter_dll terminate

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle _close _chsize_s __stdio_common_vsnwprintf_s __stdio_common_vfprintf _wfsopen _wfopen_s fread fseek fflush __stdio_common_vswprintf __acrt_iob_func ftell _wsopen_s __stdio_common_vsscanf _open_osfhandle __stdio_common_vswprintf_s _read __stdio_common_vsprintf_s _filelengthi64 fclose _lseeki64 __stdio_common_vsnprintf_s _write

api-ms-win-crt-convert-l1-1-0

atoi wcstoul atol _wtoi

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _wfullpath _wsplitpath_s _wmakepath_s _fullpath

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

api-ms-win-crt-time-l1-1-0

_time32

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Microsoft.Extensions.Configuration.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9e4bf73dfed3d5aa9ff25780e87109a985cb6e2feab30bea42689cf7d1d4ed1
MD5 542b6ef0d8d600f43cecdaa5fe6a99a5
SHA1 3e5626ab326b8e0a08d48f1347c09eb3a8b1b882
SHA512 4ba7499c2b5cab18d185f63f857f8e94785642b5d0909d2c978b039d8920aadc0401f57ab7603f2ddae396c4c8edff5f56b31de36d24620733c9847f5b3152cd
SSDEEP 192:DMt6XYVhN6y0mb+dXM+4POdTJ6V2fGtbn/PTG/AxXEzRjz6P+M/FbSZbWsKTWM:D+V/6PI+1z8bXTG/ABEzRjz6P+M/Fbk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.Binder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4950a8400717903c28cd5b9562cff761afe5ac3470ab699855a898b29fe8a2e3
MD5 99ed54569b703e903f674ea4eda6c662
SHA1 5c59e3c564b4c057ebc1455cf7bc219b825aa11c
SHA512 fe4937471fee583ee73411eac6e256a622c2f8a10d885e2096546bbc93e393435fbc20d40b3f885f48f48767bfdde906209890e9088318505b10d84a7d4ae7e7
SSDEEP 384:dqnWO8HPEfXZ5PAxmLKRTuVWU28UJjyFygZ7gYU8ud/WiaGWM:dSWO86zgm0qfUTMuY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91be5d8e169d4e809d077108827c041988018f37924c312dcf3c3c77264eaa7c
MD5 d29ef3e603946cdd964ded903c205d62
SHA1 959896475fe1dd758adf857b72bea25cdcd405cd
SHA512 3f82b58932bbe771fd102065399e36822f061c769a211b85661d4b0575cbca90cd18ae92d76101e2219f22bc247a163ba95718a4303a6d43784723437f7b88cc
SSDEEP 384:/dfVJtVnucJYXVJig3xLm+NMsTks7WK4WJeVWWM:FtluT31Ugi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1663be664cb7a7afa5786dc9f071fca8aeac3737fe8e29153f29223c8ab1608f
MD5 1cca6bb1ef856aed16e29b17b92ea225
SHA1 59bcdfef44880db1daf87951619cbc776a22746d
SHA512 6daea2c19e873594e8486ee09ab0cb9d30e4f76a1ba51fd3c2a40ac5c27c870e1e7b533247c17b8386c9016103d1423cd886efbf1256e89ca2a8b99f0d2d57fd
SSDEEP 768:jwd02Ew1NODPOlwlwlwlwlNm/ST5T1yEf:jwd02EacZ/mJz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

32878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21d64f47e3d226854b93ec5b1f94d3b8ecabb0000a5b759decd96507789c307c
MD5 692c5f999645b4e9babc2e830a2534e5
SHA1 da1ce989d55ef32809a4c0471be5ae9e5614e483
SHA512 ee6da0eeb5617b6b0ddb754cdced46a68a4aa95e5127ed94090f3640d4d0df3f003135ca84e5b4870679b0972e3c4f6b8059bd8a9c870ce8c5237cb0930235d7
SSDEEP 1536:CPkLGoLSeeeJHlFDj4aQsxYZiKdD4Zfg+:Q+XHzjeN4ZfD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 971a367da28ccca459fe2f7d755f0cea978310fdd064f6368fb8c8af814d74fd
MD5 613442a0e2cd90d79c3401554b8fba9e
SHA1 380df211e2bada028536a6c55bc8f33495bce1a2
SHA512 ef9a5696774f111a7ec99a6cc96d976e761faee4e128510f278a6f606de3f898413808f4c53cd19d27e83a46a1adef945c60d4bdc41f2aef70f710027c6bac87
SSDEEP 768:qwHqGdhpezbPK/QN8jmN8CduUNxYci62wyq/:T3dv6eAuUocywyi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

43966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30f4630b82b19f77abf33c8287cf4a00e8285aa71df1bb3fc05b7abf9026841b
MD5 1649856f9ae8ea8aa53b5aaa04da894d
SHA1 03574a2e9baf4edab20375bbf968228ca717ce8b
SHA512 20dda82a3c9501c7de052c86c09dafe4251042011305a7224bdd7bbf99f7b705cf6f5992f9fc27fdd5526dcbb3fd6caf6fe2128631c769c59fbbd5c639dbfc17
SSDEEP 384:uUNoqS641Wkrb90zrAj1+dOECTEPC5nnAKacrWYrqpWraVWM:uS/SkkrbqxdOEQ3AFchr+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1332dfbef2bb538faed7c85ae6f6c26d64333eed95486e3f81c9f2c1af5b9f33
MD5 e80731180d3f61c207d1e759b5e422fd
SHA1 c9a8989cdb44ae95f6f6404a6618bd001ddf95fe
SHA512 da74e650dbe60705e02882e7877cf0f5e7f08c1a17b3da5cd892b9a66fc06dfc7be8e324c13d8df17f7bc9898f22b399e0e81808c76e1274f70b6b1f58564a82
SSDEEP 768:JmOSgq1fwDct4Ipp8nV485AoX5R9iV+Wml9lblyMbWndaM:O1fwDct4+YJA0R9I+X5bo8M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6a9d514f14c4bfc5e8b8f00493cd82f9ba55964b65941bc854f7a1c2bb9d7a0
MD5 fdd402c39c38f595f9aad770442330e9
SHA1 f4baa5ff136f6d4d662f7b6200df6a458cffd122
SHA512 14ef7e201b7de5188674c18e9fbacc4a09525305d4a8f196de74d50a016e76eda8fd3f6ed7743f9625831dfdc8ebf2f970a506b892b93301e6d3b416b5f17c01
SSDEEP 768:Tm3/GX+hgtDQclApPOF0vWusFQkuivm1/LcXJ:TA/GX+cVO1OF0v3sqkuiYOJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

34142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Toolkit.Uwp.Notifications.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b14999bfdbb2a55f335ed3e9da022a73e9ff6e96ba341ffef22637a6f1826188
MD5 71829de02b099241bad4ef0efba785cf
SHA1 625aca08f1b7020456303794543cc669853003a3
SHA512 dc5248ec12ff04db6722d6640ce2eab8dbf154ceaecbcb5f473e4ca869f60ada4bd136d849db82524743c652f2bb27d08870d28e2d54977c717b73fc853d6557
SSDEEP 1536:I3FYVCl7jqFaTsU6+QFBwkGKXX/3+fibJ+zGgr6j0tdISOUpUfZ:ooClnxsU6+QFtxXX/3+2+3r/c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

1a:a8:a5:6f:e0:19:7c:75:8d:62:66:2b:14:a6:cc:fd:85:59:5d:68:92:91:b7:62:e7:c1:3c:d2:db:5e:d0:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Chains

Aug 12, 2020

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Serial Number

0e:71:58:6e:7d:8a:28:36:54:3d:5e:15:d2:b4:5d:e4

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 11, 2018 - Jun 15, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

109974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Microsoft.Toolkit.Uwp.Notifications/obj/Release/netcoreapp3.0/Microsoft.Toolkit.Uwp.Notifications.pdb

Microsoft.VisualBasic.Core.dll

SHA256 d5bbcd1b789332e53c3c84b6e6b186e876662edb0978115cc6892e314b80f34c
MD5 c6156a8d9f40d09fdbb0e3befac6d900
SHA1 4d269ce5e098779beaeb1180689f1e9fb0dac79d
SHA512 b37a3bcf564421fda441d95f18fb29bb3e369516be31f1abae51f71618d74730b46c75218aff305d1f1c40253d0962d30cd4177cb949ceb3182f0ab8e2878a8b
SSDEEP 24576:k2o6FIAG8DXwIB0RLQh71gPOpxEDoQt7gGw:w6FjDXwAps2Itt4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

60:e2:6a:a7:bb:3a:04:d4:fb:bc:ed:62:aa:7c:f5:60:80:4b:43:60:f7:d6:11:b3:f5:28:69:25:11:ec:01:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.Core.ni.pdb Microsoft.VisualBasic.Core.pdb

Microsoft.VisualBasic.dll

SHA256 e7d40101567411f72d1633984c6cdf9a130303a90e91448a65b620627734c8d5
MD5 40868717824d16f5d57e4986238f0f9f
SHA1 22a681bb25ad31b6321f79444164f041bd569dbd
SHA512 29acd918bca6b31ece683aa9e118a7407524582de1877e188f36916086b75a103d2cd8bb2b33b7f5f011910efb605c1b6fe761ad608dbda2271efc2ed6b57d09
SSDEEP 384:bxWmH6e9QKWMQ3cgznLnq2AD/HRN7TH24rlGsYA:lpQMgznLn1ADvD6m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

af:2a:d1:e7:eb:21:30:51:1d:22:72:c9:27:3b:31:cd:96:b0:40:fc:da:65:7b:42:c2:c8:ba:0d:6a:ca:c3:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.ni.pdb Microsoft.VisualBasic.pdb

Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2870c7af204968e6c9124db16b8479da9d115be41ffffc26d515fd4e8517fb1b
MD5 28b8002579ed83602cc54dbd8c05d591
SHA1 a34dffcdd8ee3e1893fa01afb06bda13e0157584
SHA512 cb19487010f06ed472ba145727a314f2e063d1548473b9c0a7c041ef99cce2183765f08a227f6ff15ca2d8d54629d2d34515de8d19a180a04d5de3c94a310d0b
SSDEEP 96:l0TYpaXzERVpxxeDZeoIqA4NVPiDKWUOLfW+fxv87xbO+XDS8vcDxuaWhPveW:uspQgrpnkeQwRUOK8xEdrt3aWhPveW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1af18aa247c88bdfa1dbee361b6b901e541c0f7a0c1c31336d65ed5176b13e39
MD5 47c158136040881155f35b4877460849
SHA1 a60ab328c456cdcb7f71e14358a0ac202287a534
SHA512 14ff78a7029229c046117afc1292c3a4712dc3a4e3c4ce735781deab842b41a9bbb5fb516f19eb614299199074bc1da583d903bc08dacda6b8eb969f1bb78525
SSDEEP 96:MUhxTU0KDgJtLuWcL1v8Pcir4c2+qR3nsluxvbo+mDmDBEbKWFF3a9wxW:MOKDYrcL1cc1UsXxhfWFlscW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0ffd19fb9cebff013717fa0619c69f62f8b52685a58882aecd1f3e3caeba7b4c
MD5 fca192b25d346fb573d5bfbfdcb3555a
SHA1 b8cf88497fae67484bca64abe458c25097855888
SHA512 1b091b31bb0dc55f86346166f943b887a436eca8fe58dc539b82447223675792d505812958446914c0ee92713a2340281e840567cba54100101bc92d4f839ea0
SSDEEP 768:EnNkMiBZdxRhmlhOPXwYMIKNwqSAVi2wsd/e:QkBZFhmlMPXJpkIAVidso
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

39326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.SystemEvents.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f05110e122fa7c73ac3571b82a0bfd5a8462a4b42b0b945c4f901928a29f3fc
MD5 fa51d1d280c2114a1de24feb9be14a32
SHA1 aa0916a3b709e2a19b7d3a55d2fdcb9cac333f88
SHA512 25c35857c79e03538825ccd6b87cee1d4a569d871889fd256fa413d69585a8e50340a0ececcf1824cac4ea976e15a3eff6ab367b0c4846f66593e0f67d233921
SSDEEP 768:Q8lYXXu7a7jtvp4VM7/9f+5KOo4KD2lJzPIsFPbPDT+9NWIc5YlL3qj:QyYXXu7a7jtvp4VM7/tSKO3KD8IsFr+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ea613cfa8e489c15d44bc1360e11be1d321de2d0327386df657425db4ebd847
MD5 2520a5a2506531cf6f8b4f2a733957bb
SHA1 202e824c042d89400c856a64624db4bd98e51f52
SHA512 8a95c483023177a8a88a1ebcdf8e00577f14a7b8603b722896ba1c714b2cc10477a74a0ff0bf7ffb70aba7e51327e54d07ee5dff6bfaffbb0ef51f08fe9adfac
SSDEEP 768:jOwA4HYdvQRXNJThTFYZSRcxEpZL5BWo1J8Bm5LhPUEfTZ75QluC9cjQvU+FlsLv:jOJ8PXNB5FZPL5BmBi8Ex+lbjkv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

71502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 839a8f2b052dadd685a7222f69c42c11edf9f1e06964dfddec61320e9f359a98
MD5 94b6fa3995eb2ba34afa532b9fab39a9
SHA1 42480243477d813498bd83839cd16f6b7b828e96
SHA512 3bc4eeead6053cbf09d48297b75e270117b52562ba21a71d8163e7dc932f02c837fed47a813d6dd3efd43812faf1c9cd934e43bd482d8664fbc5191437bb6d90
SSDEEP 48:6xJk1fkEdDhOGGmntavItLNMwxLFvLmehCZutd22JMKM6ER5MtR5MPTHX:4SkEdDaOXv3Jv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NamedPipeServerStream.NetFrameworkVersion.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 463e1a53996e8de4d2ff2a7b3919e24358c1895da120060d32c1bf4f9462bc83
MD5 f8d4f30967bf2a130721f2ebc084cc7a
SHA1 14d81ae3e20c321636262cfca5c2fd6caa59fb9c
SHA512 a9cdf2ae64e408349e321a69fe609f7b9e7d14505468c9d986bf46fd9ac77d5c79bb14eefe67f6b977705150a2787a41b74e685545240d7d60c524b3bfbbcbca
SSDEEP 768:g/VWCKBOs3a0k/c6sYB3zYD0DvlRGh/D/QPi:6WXBK0c13Bu/Ai
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netlib.dll

IMPHASH 214be4dc89fd43b09b8186163987db4f
SHA256 40ebcc6308c580d8540671fc2bcddcd5dc474ba1289102cdd302d0b401a96129
MD5 69a15c87cd9691ca995f1a6e93b85a74
SHA1 e43dcc198f69cdb44ddf688dfc7e2aae72c88fe8
SHA512 5d558ba5efdb37b0f6197a812107fa70404a778240b8cd7e430a88105753e012bc74b969a72c63e8d96491fe820aae0e1bea5ec07b07c938f798b15621467bf7
SSDEEP 3072:PJZLUNTpEt0Tf1WK2vDYpo0cHxknD3FBVWZ9C:PJa1EWf1yvvKFBVcC
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Netlib.pdb

fwpuclnt

FwpmEngineClose0 FwpmFilterAdd0 FwpmFreeMemory0 FwpmFilterDeleteByKey0 FwpmEngineOpen0 FwpmFilterGetByKey0 FwpmSubLayerDeleteByKey0 FwpmSubLayerAdd0 FwpmGetAppIdFromFileName0

ws2_32

inet_pton inet_addr htonl

iphlpapi

ConvertInterfaceIndexToLuid

rasapi32

RasGetConnectionStatistics RasGetConnectStatusW RasEnumConnectionsW RasDialW RasGetEntryDialParamsW RasHangUpW RasSetEntryPropertiesW RasEnumDevicesW RasValidateEntryNameW RasGetEntryPropertiesW

kernel32

DecodePointer EncodePointer WriteConsoleW CreateFileW RaiseException CloseHandle HeapSize GetStringTypeW SetStdHandle GetConsoleMode GetConsoleCP SetFilePointerEx DeleteCriticalSection WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo HeapAlloc GetProcessHeap HeapReAlloc GetLastError lstrcmpiW HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP

Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 74deaa342747cf77f6efac6bee1cb6da2e7fa31988b3f1304eb1d01d621ba4ee
MD5 3c88cafb11eb9ee403dc2980edfaed36
SHA1 b9664b423200e28882a8e543cfdb8bca5ebe25de
SHA512 c5044bcc98bbb639c40cac5b5333c890feb4afb2d54b55d5d702ee7f83d86d3aa329303f88c70683f89658d7fca279104bd2c94ef3641a6fde522716c8365dd6
SSDEEP 12288:7QXc8tdRz3R5TzIQ/cVEfH9LbCtubHkttbXBfGpYoC:kXX33R54Q/XbCtuWhXBfGpYoC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

688574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14e949e8c2eff5bc7afda30804bdab15e293fde2c9f573c8d52ece54bb21c2a0
MD5 49add3e0dae1181cffc0d4dcde4e9502
SHA1 d2941dd7672b7e1d20ffe3d70dad84a71fb33852
SHA512 daa90a6db7cc28f4759deb2ffd3dd8c8f981839a8cca1299ebd558b41488ab0d9c56bda336396e7c6f46af192ca0fb02afb5851b66c65c47e3e39604fcdbf8d4
SSDEEP 384:iHd+/aJB+7+atTbuKE6CY+CTbkKM5E9P7EljEeDFkoFhx:i9SSaJ6KEpdBdrzx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Coordination.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe34dfb558d65d8b072f466021a0d15de8d202513b1f13a7b45ffc3e9125b588
MD5 805c7a0a6c838cd2e96b402417638ee9
SHA1 843ae9a6129c73f17df1a91ec09c4ac2a06099c6
SHA512 ccd6383841af4188b448d1ba153672b5861814ea8570d29ced77cffc10346c403a6f37bbf2d003b705f7a50a9c008e3a5e45a6bc30f617d9a34f64e0bc103e55
SSDEEP 768:m5MwEXdl+dbSMyWJ9TFOOo8pufD1oq2UcgFixdHGIcxCJVENySzWi+G:m5MIOEwJoDU1ixdCa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Interop.WaitHandles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f6c3af2124d0a7385ec595093062ae203573167332473c0dd6af323a8010190
MD5 a4a934cb7cda9fe457e751f43946b47d
SHA1 4cce8c0d38247450b158de3abd320003da9a4844
SHA512 15862a759007cf6211e0062e5257468e86f99868901c6565c08e6c401f9035ee86e2e639ceb8843ed4162adff35b3048c222948565a46e1df25b604254d9aa2f
SSDEEP 96:QH+IoX50CwqlKA2ANwIIv/GWnNwAh4TqBQBT+mu2hDOLFio1Xr5vKDAl:QpovZz9cGWiwBOa2hDOLFiWVl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Oop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75a30af7c9e46e45e6c2b11a8284d5eaf681b8d71e531200d4b480fc66b0f65e
MD5 73c77e64e8e1f0f010fc4158a1a7060f
SHA1 ed7a2e982f5475d4479467aa248e1e6cc4adb455
SHA512 0fbfa1d573da283c5898e9222349c523cb9c8b22f650af24b6980ab9202249020ee74e079acb6ed9ea3c1a74debef2aa70d33448d1012fc66868fe2f8db32c77
SSDEEP 96:zfaZaAMFhVyhCEvX7O+pqCbS0X1V0TzCw1:TAQ7QX/KCqz8eF1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edef045c965f1dc14805cd66e2a0b2cae2bb34aa2c8e80468f34c34446906d0d
MD5 17f57e0d9b7c5cc602553301cd7b1607
SHA1 cd7567d67967684e72ba10d24c47e3d5c0eaedbd
SHA512 759fcc7914add3c80080c6ed9da94e9fa5e2af91752f5d7846b8cf01cc261b1eb76ba59188b1391d04a61f7ffffab7b68e0d8ce3f4b5b81fc4ff53c4aed78bef
SSDEEP 384:ardaj8E2h7/D8tg1a3FLF/pNw2QNmtMdIDToMiOrS6U07dYdt0EYP8R0OekBVg2B:Jj8E6oflfOtdgTo+/Ugd6R0UVk4m6z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Cancellation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f905ec7901dd2b3e59ec23142518996769b3c6916075776319a1c960fbddef08
MD5 df073384d167ac9baf66b991ecd6df79
SHA1 1278cb3cb7fbca5736fc386ff5e72053c6eb0f28
SHA512 5d06ca462cdcfbf4223c1b354c3578a8074e15ce850b91861f642c1d9cb29ad31fff9c16144dd2e34c289788b678296a7fc3a664c4b27e655d39415923432330
SSDEEP 192:VE6Vnko3LO0Gnr1CPkjMD1oE8jEXXwgRh:VHHO3nWkjMD1oE8jEXgah
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Collections.Deque.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 570f6df8ea487a9977c23cca5ce9ae582f645f057015ef779bb1c75afc208052
MD5 f37027e4b63b3f6468fd37332684d105
SHA1 68c3e376ba053990875dabf222fbb320b2495a8d
SHA512 ca8c0eb8a5b884d015131de216d97045a5b7e7ab457901db231b28a289d829803adfe18f58ccd26b153ebff64bb542cc8a7cf0c5f628e7108aa02196933461d5
SSDEEP 384:WRLkjeUXeOVXGAUbDYNt93FLr+hK9oY7W++wj8a7WwF5LMmXU5rGoMjnJX6eP6+3:WNOVYbo93FLr+gnEz01/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Disposables.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 36be2376633d785adec9031ea49b2f578f50d5d2c74babf86f44566b903b4197
MD5 e4f25b163ce2b0cfdd30e22d2fed7e07
SHA1 16ca226a1380d219ba511a872eaea47c51818d76
SHA512 5afb2c7b8aaf67eb40964bb0fecd50a9522aeedbe18fcaa3fa02c7305ac3815f49a1e17732fa6a3f08f79507b0f2e19e1bb3cd0246ec3c95a247f7c789c3deec
SSDEEP 192:w3zvRqpaQjjXdct0MDxRYJEHrlBqw16ho:Qzv4LAuJExf8o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PasswordExtension.Win.deps.json

SHA256 246856f33ebf090da18174656f221783f2aa0f981cba1a845c546f92a24f5215
MD5 7e6eaad920b2f826a3c5931f565c6a72
SHA1 fd03b861c4edc6f9c40db696524d96288ba13868
SHA512 1566f95d2803c1e098d8ab2d5b7f50ad95a3158847a882deea44b0560c91ac7450d2e2b95aea2f20004f64d1191c9b951d86efd015fb22171391f44c020b8cd5
SSDEEP 3072:dzLGKgPSxot1Y9Im07R1ARkgT9ueGtHZqeagPwZgn9c:RG+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

PasswordExtension.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7043b841f0c6faf1150d0fb0c6bed136bc1b88493e8d610b4e80fe3bef6f1fc4
MD5 5199a0591a0a9c03489b9a09543694ec
SHA1 7a557b90e3edb537ced4e236385984e3ce23bd2b
SHA512 342abf9d24a6044d84ec792ac2f2f42dc1f72db6fa89c67d1f76c22837003007361f89ab055f203f3e2605f950068b6ca50aa02672cce45e5bf91f1611ff6e1d
SSDEEP 1536:hyTSO5W6+RaNkRi4ITqk0uBWF2ptqw1qU:U35DxNkBITLgF2/bB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d5:ff:b8:ab:05:91:1e:f6:eb:ae:8a:9c:8b:29:d1:14:92:d9:42:67:69:da:ee:79:9f:50:eb:b1:97:a1:75:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

72990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PasswordExtension.Win.exe

IMPHASH bf1462ce2cfa173883d7ac57d7af7b93
SHA256 f8cf2439ccf3b51ae76785bcd3fd9e9ff52fb3cfaa608ccd1ae21dad4c8561bd
MD5 e14937c4646335017476a7464e880424
SHA1 8764686011799509d4d92716ea3a4de6a5eb8729
SHA512 7f977f94350ff945fb89705bcec113c3721b1150c57ffb3ea05918aee1905f87cfc0fa524582f2852112f9a46ab0ceaada145fff838a968bfb7dc180464cb2f0
SSDEEP 6144:jCVaAcfAFOFvxSP/vUkXVXXCXXzXXXAXXXUXXXPXXHXXXHXXX3XXXXXXXTXXXIXN:jCYxf6OFvE/IKBzP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

85:04:2f:87:92:d1:e6:bb:7a:2c:9f:06:a2:bb:e7:d2:a3:b0:a3:d8:80:2a:fc:0c:43:c7:74:8a:c6:f5:62:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

71312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwind RaiseException OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

terminate _controlfp_s _register_thread_local_exe_atexit_callback _errno _c_exit __p___wargv _seh_filter_exe __p___argc _configure_wide_argv _cexit _crt_atexit _exit exit _register_onexit_function _initialize_onexit_table _set_app_type _initterm_e _initterm _get_initial_wide_environment _invalid_parameter_noinfo_noreturn _initialize_wide_environment abort

api-ms-win-crt-heap-l1-1-0

calloc free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode fflush _wfopen __stdio_common_vfwprintf fputws fclose fread fseek fwrite __acrt_iob_func fputwc __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcpy_s memset strcspn wcsncmp _wcsicmp _wcsnicmp wcsnlen _wcsdup

api-ms-win-crt-locale-l1-1-0

__pctype_func setlocale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func localeconv _unlock_locales _lock_locales _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64

PasswordExtension.Win.runtimeconfig.json

SHA256 dc4b3413e739405445afd837bf5bcfbae96c1172f60f2c397a80b3f7dad8c99e
MD5 fcee6bbea41d26598a182ee769296702
SHA1 694f9ac9bfce76c821bccf8ae3dd0e99be5f6180
SHA512 b2b19ccefd60733b9f13ef1046ca0f825c3603afe6ab376157dc287a06bd8081f9dc067a828db426b7b92038181aa3af6746272330284ecdf80984ec0a38d1f1
MD5 SHA1 SHA512

NSIS installer

installer

PenImc_cor3.dll

IMPHASH 897d4b325f4d1ecbf05e1d417468dc0f
SHA256 bc9f6d25fb93f9282e04f2765ed3402d7f9ee8f19a1170a4e133e33caa557bc9
MD5 0df3c56e364ab8b2a1bd52f00718db4e
SHA1 00c9484b184843768e99a9648ae5d2f53a5f9ffb
SHA512 c90b1d81d46bac3bb13593d28fb749379112bd987adc7cedd4362c37ee52c085bf382f4d1c4bfa7faa2b7c68ebe77304018d049489bfa3916ea3e4c2837d33db
SSDEEP 3072:hTz6cUAtV/MEqRK8eSUkW/fmddtMUefY4NOrr:BUA9QUkumi3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

af:71:ad:d6:c4:de:26:8c:e0:0e:dd:7f:aa:4f:b2:0b:6d:c4:50:7c:d5:78:90:49:08:69:31:f6:c7:13:21:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

68944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\artifacts\bin\PenImc\Win32\Release\PenImc_cor3.pdb

kernel32

GetThreadLocale SetThreadLocale DeleteCriticalSection DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx WaitForSingleObject ReleaseMutex InitializeCriticalSection CreateEventW GetCurrentProcessId OpenEventW OpenMutexW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetEvent LocalFree SignalObjectAndWait IsWow64Process GetCurrentProcess OutputDebugStringW CreateMutexW CreateThread QueueUserAPC SetWaitableTimer CancelWaitableTimer CreateActCtxW ActivateActCtx VerSetConditionMask LoadLibraryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedFlushSList TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CreateWaitableTimerW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind GetCurrentThreadId

user32

MsgWaitForMultipleObjectsEx CharNextW GetWindowRect EqualRect CallNextHookEx IsWindow SetWindowsHookExW MonitorFromWindow GetParent GetDesktopWindow GetWindowThreadProcessId PeekMessageW GetMonitorInfoW UnhookWindowsHookEx GetSystemMetrics GetWindow

advapi32

ConvertSidToStringSidW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteExW

ole32

CoLockObjectExternal CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoGetApartmentType

oleaut32

SysStringLen RegisterTypeLi SysFreeString LoadTypeLi SysAllocString VarUI4FromStr UnRegisterTypeLi

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncpy_s wcscat_s wcscpy_s memset wcsncmp

api-ms-win-crt-heap-l1-1-0

_recalloc realloc calloc free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table abort _invalid_parameter_noinfo _errno _initterm_e _initterm _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _seh_filter_dll _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

rpcrt4

CStdStubBuffer_AddRef IUnknown_Release_Proxy NdrDllUnregisterProxy NdrOleFree CStdStubBuffer_DebugServerQueryInterface IUnknown_AddRef_Proxy CStdStubBuffer_Invoke CStdStubBuffer_QueryInterface NdrOleAllocate CStdStubBuffer_DebugServerRelease NdrDllRegisterProxy NdrDllGetClassObject CStdStubBuffer_Disconnect IUnknown_QueryInterface_Proxy CStdStubBuffer_IsIIDSupported NdrDllCanUnloadNow CStdStubBuffer_Connect NdrCStdStubBuffer_Release CStdStubBuffer_CountRefs

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

PresentationCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b9e633c37c9e8921c563c948e6bb13f2e4f410336831d077e317cda76608c291
MD5 e43981defed2e6a3b4ea506e79f4fd64
SHA1 e78fae4a78c47a89d5684853fc4419ac639d555b
SHA512 445942d6ebe95e8e78ca3a6800dec396843f5df680ede0b7b3c5ac6a7d6f3577ca6687c923576bbb3bf3e801276d6e89b6709e421600b8d54bfe9196fdee8bab
SSDEEP 49152:h1FB6con0Qe94r8LXI/LpIg4+ftm/Bos8DdDxqJ64r6:/FB6cg0QlCXNBos+dD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3411678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a774ac837daf582d68bc558d50df8366f8c25f153b0be35b2ab0cebb77984163
MD5 1720fe4e99fe220dd27bdfe5fd83d13e
SHA1 a59dc874e125bee4503bea1b67c6c4c2c915e475
SHA512 89ac9f3ecb08c8b492d7a2c0e29f3515fada52698ba5e212adaed838df9f395abe687553ab89fd13297890d34a0ca96b1904ef721bf40dc34d88db0135001545
SSDEEP 96:88eLad5BlSWyfkmgE5/a4MrdtonJY7h2mziS+Df0v3sGK1NQcXS+3zkuU0++hD/s:yiJfyDC5tonJAZv+bR7i+3SmIWu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemData.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f4f07cf78674c4396cce6ead7d9e67ee7e19967300bd952971a28ace83e6bb5
MD5 dc5b32f296dd7294fc45e47370eeaa9c
SHA1 84759185c844d6230cef3e60b852e1d8820676f0
SHA512 48c20f332bd161d2fce0961350360aacebff6f40d2183ac2782d868c7010b353a317eb56d1b6a4eb6f961956fef07223ceb97f7df005e960d77aa010fd0efc8d
SSDEEP 192:mnaA9VdksMR05zgo5f80zupxWKZWbzt1IWu:MpdMRvo5kaDK8KWu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemDrawing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8c7a9b0e95c3e5c97f4003867a0cfbf5710e32fa2888a9c0edd62024e98daa6a
MD5 c14af45125a881981f38b4608bcf28bb
SHA1 0ccf7031204db24060b3bd7ab3cbe30c4a3ecb8b
SHA512 ca8767e79bd6aaaf3c651fe2d445d1120858e270dafbcb17beda878fcc8c3b51b7ee8d28aecf059d1f199389c8f1eb7c093e27ef923ddbdb3231d89b23099700
SSDEEP 96:WMF4vTr+1+hsYopreziMit/ziozRoNCn7+s1+hD/DialiWPra:jF476xrqJK9RoNCnSqaoWPra
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemXml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 061b0fba00b00349c9f40d8268ee71ca22e23b40f63e6f54fede858e3b8368fb
MD5 6c533d564b5b5b9feae1ea582b38b833
SHA1 6e9b3ae897f01ba4ce6be48f7e479a9106729cb9
SHA512 7982684b3067f1c734b5ad4b71aa6d282b0e0312f4d198644c47c7946a32e59685e476f6d95d6fab5cc23f5427085483035525bd4cbe713c471cd0f605ab04c2
SSDEEP 192:C9Z9blQ/MIw+zsT1tTTtfDo+vGjITpZSoWL:C9Xp+M3+Ut1fDopjITpZtWL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemXmlLinq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d187fba1ea94a8804f35acf9f8f0303c9cd2c7c2ffb9827eb816907c00771db
MD5 b68be68764f3c610298672f0a437b2f5
SHA1 ab5dbb9487c2fa172a67fe72f5ccd319a9545ffc
SHA512 d1c19d2786f1e0567652b01ed853c1244a3d9b9285545a8676c0957d412d668c7e66da53094455600a10864a47e12fe82e128297ac946d527e9e3d9ee6d06a34
SSDEEP 96:u4wUFNYepHQziY1qGuuKWzMC+hD/DiEliW/:u4wktpH0t1qGuuKWg2EoW/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Aero.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 01d69fd6daace9877050c62949f12d3fd2ff5d364f278cb7cc35d97a09b5fa03
MD5 fd94ab64a24fa20107ad8685cf43980f
SHA1 5323fe526741bd0e5924929c14c05650127863e3
SHA512 d8c0e43b01329b59528f5490a813b89a31748bc709cf19240f292eae9f2a02c4f033c3dbf8bc0e1aa0f271d347b727c3c08a05837daa86d395357ff0c705f203
SSDEEP 3072:NhFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZW8WUnkXFuW6tuAVyTMwu:oaoj8ul
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

241518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Aero2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 73cfd7f30c7d1aaa341bf908c1556fc567b63c8d30a652df91a4c29edc8e2181
MD5 94111e29f110a4a0428e65a09fe4c912
SHA1 20a0a6891048340f3f77bdee58ccd57b2d815e18
SHA512 67cb3d67949e190c6f4208fa061b3ab384da130945240fb012c0038baedb52bf62174226e0a425e03669866417fdce8fb9fc1c251fb5e1aa611972e4676dfed3
SSDEEP 3072:whFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZPGUnVHiFcACQIIWTb3:BaSUnVEPCQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

247598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.AeroLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5000940f13d78d3db3f3b2cb4926c49a93dea72f9f1bc671885564836a684fa2
MD5 b93f80a4392eadcd59dd1285f1aad0ca
SHA1 79fd86555a2ee128d11b5f450253ff14845ada30
SHA512 b5d8de20cc4cd26b08f63bafda3d1cba2b92c716eb67be236d6fdc6a7ac82c831144e7930322332088419140bc3ffc09897331eeb72b175f4b435e927fb12913
SSDEEP 1536:8oauV8x9p/uvS++D1k9T7DwVNSPoV66yEKMtqWC6XOz9MFhpLBS+FN6LsbPCXbPv:8oauSr0K9K2SwFhpStSJa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

173646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Classic.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e4e678957f8efdebe05394c74c4c98785f5c3961dfbdbfb11ed16dbb0086b84f
MD5 c50d33a2d5fc712866de32ea6dc46bb0
SHA1 8fef0f8f1516b1cbac2f4bed8cf8c6bb8c186e00
SHA512 4ee0114ee5c5970c50dbe9efb2d9e2c87a96358537a85884d97e9f3c2cc645e9751014503d9cf1e7b35c5912bf17baac26c05d3394d3951765124870ae1c3088
SSDEEP 1536:vtxgsnh7pkcLCX4fSFl5UXEUlFCpHVpltqznYqafevHnfFtJxN5zJf81OSmOHOLx:Fx3h9cXxFlqup3a2I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

183406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Luna.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9cb1d26f2eb8d1f2338f92fcbbd5a11b1cf9f79f66d4313facd48f44a532a524
MD5 111449abeef77625077551f3ebeb153e
SHA1 4860988b735845b640e84fd1a4033ef71c15be86
SHA512 cffbd525e1b56d94cec241eb7431359659f1a3e6b0a406e7cc0ad254982591f34cd55cbfa9c0a739657dc4528c7e16a23d83f3834cc5992419387dc6a70d4191
SSDEEP 3072:4epl3sO85wLbfp3G/uqv2tXFq278biT2SmDu1vqylFYNrySbjJfrLqiuqvOfmFqj:5nfQ/uqQB7Miahu1puryejxrruqfd77
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

492670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Royale.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 833bbf22e0832f60018285674a9c1436a83ac10e1a088573516f12e291816cb1
MD5 2faeff0bc2e7b64136237d1fed20f3ee
SHA1 dbca1f651c4b7c045673e69416fd16925e27347b
SHA512 dec3f51112882504b3eddaebcbde93beacf7d7866ea8ced996d96681d2045162d583b6ffbdd98d594a5974d6d855d03d072ac5b8c37b38d86dec3795532e10bf
SSDEEP 1536:wgSAnQHC9yhfbLH3zPvcut4Xs892JXcfMChHhvG0gd8LxmEEbk0qdBw3jFdENYGZ:wgSAQHUILvK96Xcfb81vFdqBHk8Iw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

204734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0614842362025af0affcc1057f85edacce39e454ba8bc9c117c31f14f22c3c9a
MD5 20d59916b3b59ce1ed80e7dbf1a608c5
SHA1 611890bc3ac3bc8ec6f644f171cfa55c4450fc9b
SHA512 8db180b4cef8701277204bc687a4a4d3d7689508f8b1feb688a90c9c9015c9e3161d6284c95a04156d407e59fcc204cf0ceaa5bc1584292928e7b508e858f3ca
SSDEEP 49152:/rZqjkRrjNEOJf4JxNZEO0mg/c926Q7lucfzRg8U/pbo91Q1SDyqsOy:/wjiB9JwpQ/cMnP1gr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5788574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationNative_cor3.dll

IMPHASH 1ba17ed539f0828d6eb789fa20855dd9
SHA256 087f2d5e17d470a88dd420b4fecddea7046cc25dd294e18b04cba09829b4762a
MD5 87d1a81e04d48252f509fe4d185ee7ab
SHA1 8d1ad29fc57de059a134c497fa9ed69f2eb57099
SHA512 a3749fc6af4bda8d98bbbdd984031a8c060e9f9fcefab691019c583b50d93de90d16e55403b39df88a8aa226337736c18c373f912417b7a3314dc3f87cd03b77
SSDEEP 24576:K49ZjtIEexOuoB2N17UxhzHdfh30heFufF1OvJ+50PaRHwGgf8J:K4/jtIEexOuogox9HfEWEF1OxzhRf6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d4:f7:74:21:5f:ef:a5:10:59:f5:a9:0e:12:c3:36:6d:c6:05:4b:c1:28:e3:a0:99:a1:c4:b7:41:8c:e6:ef:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

5568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\artifacts\bin\PresentationNative\Win32\Release\PresentationNative_cor3.pdb

kernel32

TerminateProcess IsProcessorFeaturePresent LoadLibraryW GetProcAddress VerSetConditionMask SetUnhandledExceptionFilter GetProcessHeap HeapAlloc HeapFree HeapReAlloc UnhandledExceptionFilter GetCurrentProcess DeleteCriticalSection DisableThreadLibraryCalls FreeLibrary InitializeCriticalSection OutputDebugStringW GetCurrentThread TerminateThread InitializeCriticalSectionEx GlobalDeleteAtom OutputDebugStringA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection RaiseException InterlockedFlushSList LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError GetLastError

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit abort terminate

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

iswpunct wcsncmp strcpy_s memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

ntdll

NtQuerySystemInformation DbgPrintEx DbgPrompt DbgBreakPoint RtlUnwind

user32

GetMenuBarInfo SetWindowLongW SetScrollPos SetFocus MapWindowPoints GetWindowTextLengthW GetWindowTextW GetWindowLongW GetWindow GetParent GetKeyboardLayoutList GetAncestor FindWindowExW EnableWindow

gdi32

GetTextExtentPoint32W

ole32

CoCreateInstance CoTaskMemFree

oleaut32

SysAllocString VariantInit VariantChangeType VariantClear

CreateDocContext CreateInstalledObjectsInfo CreateTextAnalysisSink CreateTextAnalysisSource DestroyDocContext DestroyInstalledObjectsInfo EnableWindowWrapper FindWindowExWrapper FsAddFigureObstacle FsClearUpdateInfoInPage FsClearUpdateInfoInSubpage FsClearUpdateInfoInSubtrack FsClearUpdateInfoInTableSrv FsCommitFilledRectangle FsCompareSubpages FsCompareSubtrack FsCompareTableSrv FsCreateDocContext FsCreateDummyFootnoteRejector FsCreatePageBottomless FsCreatePageFinite FsCreateSubpageBottomless FsCreateSubpageFinite FsDestroyDocContext FsDestroyFootnoteRejector FsDestroyPage FsDestroyPageBreakRecord FsDestroySubpage FsDestroySubpageBreakRecord FsDestroySubtrack FsDestroySubtrackBreakRecord FsDestroyTableSrv FsDestroyTableSrvBreakRecord FsDuplicateGeometry FsDuplicatePageBreakRecord FsDuplicateSubpageBreakRecord FsDuplicateSubtrackBreakRecord FsDuplicateTableSrvBreakRecord FsFAllFootnotesAllowed FsFFootnoteAllowed FsFormatSubtrackBottomless FsFormatSubtrackFinite FsFormatTableSrvBottomless FsFormatTableSrvFinite FsGetClientHandle FsGetColumnRectangle FsGetEmptySpaces FsGetFigureObstacleData FsGetFloaterFsimethods FsGetIntervals FsGetMaxNumberEmptySpaces FsGetMaxNumberIntervals FsGetNextTick FsGetNumberSubpageFootnotes FsGetNumberSubtrackFootnotes FsGetPageRectangle FsGetShiftOffset FsGetSubpageColumnBalancingInfo FsGetSubpageFootnoteInfo FsGetSubtrackColumnBalancingInfo FsGetSubtrackFootnoteInfo FsGetTableObjFsimethods FsGetTableSrvColumnBalancingInfo FsGetTableSrvFootnoteInfo FsGetTableSrvNumberFootnotes FsJustifySubpage FsQueryAttachedObjectList FsQueryCompositeColumnDetails FsQueryCompositeColumnFootnoteList FsQueryDcpLineVariantsFromCachedTextPara FsQueryEndnoteColumnDetails FsQueryFigureObjectDetails FsQueryFloaterDetails FsQueryFootnoteColumnDetails FsQueryFootnoteColumnTrackList FsQueryHeightDefinedColumnSpanAreaList FsQueryLineCompositeElementList FsQueryLineListComposite FsQueryLineListSingle FsQueryPageDetails FsQueryPageFootnoteColumnList FsQueryPageSectionList FsQuerySectionBasicColumnList FsQuerySectionCompositeColumnList FsQuerySectionDetails FsQuerySectionEndnoteColumnList FsQuerySegmentDefinedColumnSpanAreaList FsQuerySubpageBasicColumnList FsQuerySubpageDetails FsQuerySubpageHeightDefinedColumnSpanAreaList FsQuerySubpageSegmentDefinedColumnSpanAreaList FsQuerySubtrackDetails FsQuerySubtrackParaList FsQueryTableObjCellList FsQueryTableObjDetails FsQueryTableObjFigureCountWord FsQueryTableObjFigureListWord FsQueryTableObjRowDetails FsQueryTableObjRowList FsQueryTableObjTableProperDetails FsQueryTableSrvCellList FsQueryTableSrvRowDetails FsQueryTableSrvRowList FsQueryTableSrvTableDetails FsQueryTextDetails FsQueryTrackDetails FsQueryTrackParaList FsRegisterFloatObstacle FsReleaseGeometry FsResolveOverlap FsRestoreGeometry FsShiftSubtrackVertical FsSynchronizeBottomlessSubtrack FsTransferDisplayInfoSubpage FsTransferDisplayInfoSubtrack FsTransferDisplayInfoTableSrv FsTransformBbox FsTransformPoint FsTransformRectangle FsTransformVector FsUpdateBottomlessPage FsUpdateBottomlessSubpage FsUpdateBottomlessSubtrack FsUpdateBottomlessTableSrv FsUpdateFinitePage GetAncestorWrapper GetFloaterHandlerInfo GetKeyboardLayoutListWrapper GetMenuBarInfoWrapper GetNumberSubstitutionList GetParentWrapper GetScriptAnalysisList GetTableObjHandlerInfo GetTextExtentPoint32Wrapper GetWindowLongPtrWrapper GetWindowLongWrapper GetWindowTextLengthWrapper GetWindowTextWrapper GetWindowWrapper GlobalDeleteAtomWrapper IsPrintPackageTargetSupported IsStartXpsPrintJobSupported IsWindows10OrGreater IsWindows10RS1OrGreater IsWindows10RS2OrGreater IsWindows10RS3OrGreater IsWindows10RS5OrGreater IsWindows10TH1OrGreater IsWindows10TH2OrGreater IsWindows7OrGreater IsWindows7SP1OrGreater IsWindows8OrGreater IsWindows8Point1OrGreater IsWindowsServer IsWindowsVistaOrGreater IsWindowsVistaSP1OrGreater IsWindowsVistaSP2OrGreater IsWindowsXPOrGreater IsWindowsXPSP1OrGreater IsWindowsXPSP2OrGreater IsWindowsXPSP3OrGreater LateBoundStartXpsPrintJob LoAcquireBreakRecord LoAcquirePenaltyModule LoCloneBreakRecord LoCreateBreaks LoCreateContext LoCreateLine LoCreateParaBreakingSession LoDestroyContext LoDisplayLine LoDisposeBreakRecord LoDisposeLine LoDisposeParaBreakingSession LoDisposePenaltyModule LoEnumLine LoGetEscString LoGetPenaltyModuleInternalHandle LoQueryLineCpPpoint LoQueryLinePointPcp LoRelievePenaltyResource LoSetBreaking LoSetDoc LoSetTabs LocbkGetObjectHandlerInfo MILGetClassificationTables MapWindowPointsWrapper NlCreateHyphenator NlDestroyHyphenator NlGetClassObject NlHyphenate NlLoad NlUnload PrintToPackageTarget SetFocusWrapper SetScrollPosWrapper SetWindowLongPtrWrapper SetWindowLongWrapper

PresentationUI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1bd1105773c3030370cc7822fdfaf7881426ade5b3d8393c463329aea2d170d6
MD5 ade2a46e7ef0b820dbd9bd48727d87f9
SHA1 58adc4072bb96a2ddef815406294130750281967
SHA512 789a2abc7435e1d73c3ee41126aee162122783a71c96cf2780bfbb884b3fda84c037642a267ae8110644fb859c5ff3d808b2f1bf1a09318d7b306a14ad6dd4fc
SSDEEP 6144:iJEFeOBKsz8cSUvVBjtTWPGgoDTcS/TXIjVQfoVGd3HyGOKusN2qoSl4vVIL9Iop:dFTJwwGlyTcssQfoVGd3HyGVuQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

834046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PropertyChanged.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 52ec64563ea08f61ef3f568699fd8a66eb5e532d5f7fc342ad46a69ccdf81ae3
MD5 4826da1d501c41bf5869823d4540cbab
SHA1 311cabfeb0aeeeda3495af1f529e5427b0241a14
SHA512 ba7475503aabb5b602ab1d748cf5ff4e55fb3a6d0ea3b67dc3c1d6142c9f87f88e814b9cd819f66cdcf2c387b3e79cddd1314a6c32906e9e71c0ce0d93ca202f
SSDEEP 96:SI/1qHR6SLIrUVGYK5wVWRyLdYag/GDC5F9:Si1qHRnkgVGneVWRyJaB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\propertychanged\PropertyChanged\obj\Release\netstandard2.0\PropertyChanged.pdb

ProtocolFilters.dll

IMPHASH 0c3f6577c4dea6e1634d3e32a034907a
SHA256 82396dcf3e94b3907c84f095002240409c14eba3c8891129004f0d44eb3f91cd
MD5 ebcbf4aafb1b7bd290edc7c545a3a300
SHA1 911ad9d11286691ebdaf6773712b83eb328eb16e
SHA512 db7d54d91ba7a169e6510534add6c577c19750ce4496bc747e58ccccda6ade9f0d236c0b704a12afaedd174fdb61e00213ff647847cde4f75de1188e58183f9f
SSDEEP 12288:kBELhX3eiRFvy4z6uZxE+j7tWZmTgmkMVeJDi9LPDMwn4jzpp7U7RwM5xXrMkmHE:koKcxEWtWZmLVegBnKX/Mg4OOFf2TaqY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

d4:84:e8:ea:6c:f6:ce:bc:d6:49:30:8c:47:03:bd:e3:34:c1:9f:ba:ed:82:7f:9d:b7:2e:89:0d:32:5d:ce:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

358094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\build\release_c_api\win32\protocolfilters.pdb

kernel32

ProcessIdToSessionId FreeLibrary GetVersion LoadLibraryA CreateEventA CreateMutexA SetEvent GetLastError DeleteFileW GetFileAttributesW CreateDirectoryW InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection OpenProcess QueryPerformanceFrequency QueryPerformanceCounter GetTempFileNameW CreateProcessW WaitForSingleObject LeaveCriticalSection EnterCriticalSection CloseHandle GetShortPathNameW FindNextFileW FindFirstFileW FindClose GetProcAddress ExpandEnvironmentStringsW SetConsoleCtrlHandler LoadLibraryW OutputDebugStringW CreateFileW WriteConsoleW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA FlushFileBuffers HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess SetStdHandle GetCurrentProcessId GetModuleFileNameW GetConsoleCP WideCharToMultiByte WriteFile GetFileType GetStdHandle SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetCPInfo GetOEMCP GetACP IsValidCodePage GetCurrentThread CreateSemaphoreW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter FatalAppExitA InitializeCriticalSectionAndSpinCount GetCommandLineA GetSystemTimeAsFileTime LoadLibraryExW ExitThread GetCurrentThreadId CreateThread HeapReAlloc GetProcessHeap HeapFree HeapAlloc SetEndOfFile GetTempPathA DecodePointer EncodePointer ReadFile MultiByteToWideChar IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind RaiseException InterlockedExchange Sleep GetFileAttributesExW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation LookupAccountSidA LookupAccountSidW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegEnumKeyExW

crypt32

CertCloseStore CertFreeCertificateContext CertAddEncodedCertificateToStore CertEnumCertificatesInStore CertSetCertificateContextProperty CertOpenSystemStoreA CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertFindCertificateInStore CertAddCertificateContextToStore CertOpenStore PFXExportCertStoreEx

libssl-1_1

SSL_set_accept_state SSL_set_connect_state TLS_client_method TLS_server_method SSL_free SSL_new SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_default_passwd_cb SSL_CTX_use_certificate SSL_CTX_use_PrivateKey SSL_set_bio SSL_CTX_free SSL_CTX_new SSL_CTX_set_options SSL_get_session SSL_version SSL_get_shutdown SSL_shutdown SSL_renegotiate_pending SSL_renegotiate SSL_do_handshake SSL_get_ciphers SSL_get_error SSL_CTX_callback_ctrl SSL_CTX_ctrl SSL_ctrl SSL_write SSL_read SSL_connect SSL_accept SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_set_session SSL_set_verify SSL_set_cipher_list SSL_CIPHER_get_name SSL_CTX_set_cipher_list SSL_is_init_finished SSL_get_servername SSL_get0_alpn_selected SSL_CTX_set_alpn_select_cb SSL_set_alpn_protos SSL_select_next_proto SSL_CTX_set_client_cert_cb OPENSSL_init_ssl SSL_get1_session SSL_SESSION_free

libcrypto-1_1

X509_STORE_CTX_free X509_STORE_CTX_init X509_STORE_add_cert X509_STORE_load_locations X509_STORE_CTX_get_error X509_verify_cert_error_string X509_sign X509_digest X509_cmp_time X509_gmtime_adj X509_EXTENSION_free EVP_PKEY_new i2d_X509 X509_get_signature_nid X509_NAME_oneline X509_set_version X509_set_serialNumber X509_get_serialNumber X509_set_issuer_name X509_get_issuer_name X509_set_subject_name X509_get_subject_name X509_getm_notBefore X509_set1_notBefore X509_getm_notAfter X509_set1_notAfter X509_set_pubkey X509_NAME_get_index_by_NID X509_NAME_get_entry X509_NAME_delete_entry X509_NAME_add_entry_by_txt X509_NAME_ENTRY_get_data X509_get_ext_by_NID X509_get_ext X509_delete_ext X509_add_ext X509_get_ext_d2i X509_verify_cert X509_find_by_subject X509_STORE_CTX_new X509V3_set_ctx AES_set_encrypt_key AES_set_decrypt_key AES_cbc_encrypt OCSP_cert_to_id OCSP_response_status OCSP_response_get1_basic OCSP_resp_get0_certs OCSP_resp_find_status OCSP_check_validity OCSP_basic_add1_cert OCSP_BASICRESP_free OCSP_basic_verify OPENSSL_sk_pop_free BIO_write OBJ_obj2nid EVP_PKEY_id EVP_PKEY_bits PKCS7_free X509_NAME_get_text_by_NID PKCS8_PRIV_KEY_INFO_free EVP_PKCS82PKEY ERR_get_error PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_p8inf PKCS12_decrypt_skey PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_unpack_authsafes PKCS12_free PKCS12_SAFEBAG_free d2i_PKCS12_bio BIO_f_buffer PEM_read_bio_X509 PEM_read_bio_PrivateKey X509_STORE_free X509_STORE_new RSA_generate_key i2d_PrivateKey d2i_AutoPrivateKey X509V3_EXT_conf_nid EVP_PKEY_free EVP_PKEY_assign EVP_get_digestbyname EVP_sha256 EVP_sha1 OBJ_nid2sn ASN1_STRING_to_UTF8 BN_to_ASN1_INTEGER i2a_ASN1_INTEGER BN_free BN_new BN_pseudo_rand OPENSSL_init_crypto CRYPTO_free CRYPTO_malloc OPENSSL_sk_push OPENSSL_sk_free OPENSSL_sk_new_null OPENSSL_sk_value OPENSSL_sk_num PEM_write_bio_X509 d2i_X509 X509_free BIO_s_mem BIO_ctrl BIO_read BIO_free BIO_new X509_new

ws2_32

WSAStartup ntohs ntohl htons WSAAddressToStringA WSACleanup

Name

.text

Size

526KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ReachFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 603b439dc38464d80c4227b141198e285c5d6ea92ada1b2ca1373a9f8f09593a
MD5 920d9a11eae89dbe41b5a817b41e34a0
SHA1 7a9162a0ad655ce10177fc66331ebeb05f58b47e
SHA512 de129a502807ea96f97d3e8eefdb95259402f7d3141568d47dd110b2fe91f51f24f5145afaaf866208c5b2f97a7cd74e93ae9da54e4b8865e25966577b61a68f
SSDEEP 12288:S3Ovqr3RAN/d3z9A+lt34Dv672/Z5YQMlV1K1Uzliuws49cf7U4F6:S3Ovqj+N/dFltIF5YQMj1K1Uzliux49s
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

627390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aebb.dll

IMPHASH d811d71710ad58776155b7a8da1fa9db
SHA256 cbcf727bb8b75864509ca1c7d68d4ef51d64a18b15b3e1145f94cd50f29746cc
MD5 f81983581bdb64f2b9234ad881b9c7c1
SHA1 a12e1674498d3859f5e867d1c958b3a72047bf62
SHA512 03fa42f9fc249be0c2269a076ec95b50e7d323587f5b1b4325549dd010eb2500b0ef8713d1e40c99a6de89abf30a3fc8a01b2d9f77bf224b5a51b2826bb53754
SSDEEP 768:9YYeKlKHPrmWYGQvredEzQiWidVtj44H6Kd3SVI2HAK2P3hh+:3PGQvrd5LtxHZcHgKW3hh+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ca:3d:4f:97:15:d3:16:30:a1:31:7b:e7:c6:6a:84:03:fa:5a:2c:c2:c6:09:32:5b:77:e4:4b:54:80:11:90:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 18, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

d3:aa:4b:46:f5:18:eb:ab:ab:eb:5e:e4:68:4a:11:cc:c9:c0:a3:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 18, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

7456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aecore.dll

IMPHASH 5d921e44c14b3b12b2fe53a7f6d0d3b0
SHA256 cef4cf51942dc337a371d3487ee87e9e2e9b2c82a34fa9b81d7beecd9e56810e
MD5 3aade81602e5fd66d24b28a8f4d0edf4
SHA1 023193e6b32112153ed8addbbf8c2feb7684d379
SHA512 08cf9bd46da4a231675bbe7716e71dc25326d8b4238cab9be28c04895e86d27ae2430be0b94a7fbe1c61a35c9d39d2c95eea283b254eb776b8ccf655638f3a7e
SSDEEP 3072:hs7523SuHq0Qx10YXQySzjqQPel7k3hGd5WKSGAL9M+OgMTZFXGH2tLg+Vc:hLbHqhx7QhqQPKky5WKSdLOaUz7u
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

3f:1b:c8:8a:81:bb:ef:76:0e:09:32:ca:ae:bb:fe:3b:e1:7c:24:24:8a:d2:34:ea:18:42:e0:95:08:9d:04:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 13, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

45:22:f5:ce:33:82:0f:6b:16:8e:71:73:f4:2d:d4:1f:54:6d:a0:90

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jul 13, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

4

Entry point

183374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetFilePointer WriteFile CreateFileW CloseHandle GetFileSize ReadFile LoadLibraryW GetProcAddress FreeLibrary HeapAlloc HeapFree FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW SetFileAttributesW GetFileAttributesW DeleteFileW MoveFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate ExitProcess GetStdHandle GetModuleFileNameA GetFullPathNameW GetCurrentDirectoryA Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSection RtlUnwind LoadLibraryA GetTimeZoneInformation SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetDriveTypeA FlushFileBuffers CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA

SAVAPI/aecrypto.dll

IMPHASH 22b98c5c8c68a5c45b232e3b1c1c06e3
SHA256 5ef4587c5e57c4b54c321e715907c56d73ace1ef727abf3f6ae52aed644485ef
MD5 77c7aed77a8358f1852328ba89c68e64
SHA1 597abdfa4738ee304f4bb049e822850918a5ddf1
SHA512 7156b8d0588bf43986582e853bcf29abc2d6cd03a957270e2c3d555744c1c82ac22420a0b036716cb954fd1d84fc86d35d8dc951d876d7fd2b0349ed8237a226
SSDEEP 3072:0dQdHHx1InHeIHapjcRa09MHapjcR7Rflj3owtq9dhT+LA:NdHH/IHlHap4RMHap4RbWKLA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9b:eb:b2:52:73:ee:fc:83:90:41:c7:25:07:5e:99:a2:b5:ad:1d:cf:35:43:a9:c4:1a:a2:9a:f5:14:c9:e6:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 7, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b9:5c:57:5c:d3:0e:f8:15:80:e1:64:be:87:9a:9c:57:46:c2:09:bf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 7, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

53567

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aedroid.dll

IMPHASH 7bc8099b6a6590ff892d32831998203f
SHA256 008d570142dec8cd337fe28216a122fad8e52f8eafa564729e146f1572d7a97f
MD5 465282f73c5bf55c9f91e01e8cca14f0
SHA1 b141c74c85e8b87591dfa883680e9588e00c5a61
SHA512 89ba2743948b5ee9cc0f375b89167d64abf5bad838777b3c179c9606df5252cca0da2830cf6c75d6a4437397dfc80c09551f6b3925a8045489652c02e6ed1645
SSDEEP 49152:jyoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/QzP+gv:jyoyI4rlfff/MtGcMnrjD4LTQXJfRI1h
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

67:89:39:32:96:38:ac:52:08:d6:2a:85:a3:a1:2c:95:78:66:6e:57:ee:98:01:ec:01:13:dd:d6:64:62:70:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 31, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

79:aa:20:23:87:6d:d1:80:77:5d:00:a0:80:00:e2:07:b1:81:27:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Mar 31, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Serial Number

33:90:20:77:61:c4:26:dd:94:50:03:0d

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

106768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aedroid_gwf.dat

SHA256 50a9af9ac743d6a7f2741a3ab39717c8c7e618630b7688dab60b57b97f840b9d
MD5 961a1c1e0dfb8b54019c9ccec510b3ad
SHA1 ced9c7e98809bb7506a17644144efcbf50bfd10a
SHA512 fca12aea31d0cb3b71b73456606b91d97f6bd3366591b65191ce6edda8b6ca8d53e07da4a5a95d9242a43b2c20842dfc1f9b39bb4ddc47058afd86530bb2afe4
SSDEEP 98304:pn7ccmeV0TkXxuwIxSt/C5ytS0BLC5KjeVdL+l/wSFHiw/OGPWqxcH8U:VccJ0TkhuLx2qyt/LC5vXGYSl9nOBHh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeemu.dll

IMPHASH a885bb13f0531bf0fe4a26dbed53e311
SHA256 daf4f56cffc30b604d238df30e96332dba84447399597cc7bfb94ab02cddec63
MD5 a77547ea30c7e99dbf395e2135d5ee55
SHA1 2383bfff89a586aae2a4e99072b5b740d7115240
SHA512 ab99353214ee63b3d89dab90722fd4026f76959e7e96085ac93a457f53df9378bfbd35ec33bf7aaee0870d0a7b8ecff4601b5b360465a60d10591204cf953eef
SSDEEP 12288:ATDo2ZqPL80e/tkut8TNPpCXKQN7f4w8TMf5DTCi5xSfkpW+KV79mgAs3n5GPo:A/o2ZqPL80e/tkut8TNPpCXKQN7f4w8f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7b:ef:cc:d3:0e:dd:ba:20:63:1f:0f:ec:f4:52:15:c3:57:6f:a1:b6:22:62:98:75:31:dd:3f:40:68:75:6d:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 18, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

f1:75:c8:ad:54:e7:e7:d0:8b:fb:e1:d5:aa:6b:00:71:06:21:82:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 18, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

314720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeexp.dll

IMPHASH 7187e63926d02e5a031851538d8c773a
SHA256 5114b2b29aa5ee2e3bd8eb2c52a9f75e2749a7933f59ecdcb3898d694f015fac
MD5 8ace5e4e409b42940145bf1859463791
SHA1 7a0ff7aad25a802f36a70f4936b699042421f52f
SHA512 7049df679deb104110d9188de2a46ffee0ebaca5b3526c7cc66546995c5494caaed3b2152a8943de7c2a9fb5efa8f4309a7bd94390956a206b82969a221592d8
SSDEEP 6144:Yz1XwJegZMXkALf8EnDx8L+rN0QmwAdWy9kvTZceYD+Pzb8ljBg0kS:CIZ6DWL+rNmjYy9BeYbPz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

dd:30:17:7d:6f:d8:07:f4:6c:00:af:ed:c4:09:57:64:ac:0c:f7:66:c6:50:d6:ec:11:85:fa:8d:2d:57:68:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 5, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

c1:52:75:df:d8:ee:d2:f3:1e:b9:dd:57:4c:1f:40:86:b7:64:21:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Mar 5, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

133470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeexp_gwf.dat

SHA256 2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
MD5 d68dbed2d9e81bb670e94b0b550cccdf
SHA1 edebaf42b7b772274ffbdf070d965aa585cb14f4
SHA512 162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
SSDEEP 1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aegen.dll

IMPHASH 06ae0e1fd5b99dde689ae499a2670f2f
SHA256 c4d2e5f648644e85412cc619691d949c2933a74b64c190ec7df0ea5c9e7138f8
MD5 a572a2f67a845e1a6bea336ea5dad9a3
SHA1 7fc49d3d3da6f4ec047397c8a3f0097453859999
SHA512 f940adf670c3c51f17aa62bdeaf6bc5f8cd3e0b9b24b1167f6a8a63cb03573935c974688bee440b3636b7672806e63034309c13d97e5e17fceddc15fbbd00cc3
SSDEEP 12288:9JzLbloGZFABTYFuym1Fp5NqAZVmW0/dvswwtZeQ82wR1fYl59yDV:fzLbloGHABYEym1Fp5Nq6GdUwwtZeQ8H
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

24:40:3a:e0:46:ae:65:ef:d6:f4:41:e1:c4:92:04:a3:2c:b4:fd:9f:82:b5:6c:cf:c4:b0:e5:63:b4:ed:ea:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 21, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

1e:71:1b:66:33:26:de:57:ad:4a:f7:6b:89:40:85:60:3e:0e:88:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jun 21, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

582764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aehelp.dll

IMPHASH cc6d764effee6149756ba277acbb1c25
SHA256 f4cca57e7310c76ee4741132e5391089f4182caa0c13dad46c2e04022fd83cad
MD5 4fd11be4967e66290090f0acbb402e09
SHA1 bdfe8f35e5dc8044e64850496c7f45d30327519c
SHA512 f9726ebace35fc1371c9eb0967bd1e834c413adbdce50815ab7d28deaf65c9170f879920ad703dcc524fde34cef8dad30818548ac4b7b04d54d11c3b9c07ce7b
SSDEEP 6144:Zg6abREzUxcSgulWoteQYMLIWlaDhDLVH:O69zPFglksadDBH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

40:50:c1:fa:e4:d0:ed:80:80:9b:fb:13:53:8f:1e:22:34:ef:9b:82:36:49:b9:97:29:4d:40:e1:c4:b4:38:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 10, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

79:ca:92:f6:09:05:81:3c:42:c0:32:0d:6d:11:c2:86:b4:be:1b:6d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Feb 10, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

161418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeheur.dll

IMPHASH c22c9e0542d8112c6f552d671ead8ab2
SHA256 fe0b17e2e99676be58fbdd69b3a15eb172d81cbf701e894ad1ac42773cf24b75
MD5 fb16fceb4abdbf6d8f1be151924fcd73
SHA1 a56c60a6efe421aea7b4710c200a79f1c353a74f
SHA512 08f88e9c49853a9fb42fdd7a7567c5a74c8819115fa5639facb89a5a9d7d2a215187f8a32436ca5a94f14372921944ac391998b7acf50fb33a18073c6b5bd018
SSDEEP 196608:3BhXYuuLuywlMGdXSCOeVNluvHsxicIiSRvHqPCvlgIScOW6wjNc:kfJV/OWM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

17:a9:29:c5:39:28:a1:32:53:3f:92:4e:24:43:a1:b1:58:16:3b:31:fd:e5:78:69:73:ba:e8:d8:4f:c6:f8:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 21, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

5b:85:3b:c3:10:70:6f:29:15:2e:bf:8f:6e:3d:c6:2d:79:a2:82:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 21, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

9610388

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeheur_agen.dat

SHA256 5032089b644646e4e17890af77f0735e78c9b0cc98fb05506239518be42807c7
MD5 068ac37ab32582b1ddc2b67c37d26579
SHA1 1d9242363774eabec85c40e9068ece04ac47b2ff
SHA512 550fd39bf1d590eeaad6a1527e4c6b72d9b266ce6b87538b834334cfebf8801be3365d941a4d61060824e13a373925b412d9502109748c08eb814c66b231c4aa
SSDEEP 24576:rrN1azun/taYrxuk3XHTx1Tx3VS2sJphZSWe1ppkaahDAAXPKCpD84IxY:PN1b/t5rE49Bx8pJFSWg2BSCYxY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeheur_gwf.dat

SHA256 b90baa70bd07bc5b3573909b37a6cf4fcccc3d7c9702806c94bd843988d0ed5d
MD5 27dbb4a716dc8d87eac34a14f814dbc8
SHA1 2f3c673d444a0b996d609136d8741f6dfc47ba6a
SHA512 dcfba0317f02771d40fa190e78c19fa2e178d0ffadd6b8d22da4be7f66a3e7983da2a0c14741ab9df0d9f034754c4ea758d758ec7a65c53f77f922d13648e9a5
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/aeheur_mv.dat

SHA256 8623727934f3cf7bf160214e47e6f3691673d82c3035a316a8f3f6e2738ab116
MD5 444837d881e5ee243e0d378318ea50b4
SHA1 ec1fa6999a8b297103199032527ac82de1f71730
SHA512 a27e2e1a5032a1198c06bfd64bb09c4ec1423ff99a43d7b05512ddd52d8da8023dd2e6ad18b1d1a881a59a49e1bf16419e42b97c119fc4164fb87dad6d9604f5
SSDEEP 24576:CXQ7NQ74StSlFGD2npLqhqi0JRh78fVNmNxrcJpMAMNbo1XeA508eY5pp2jAVkW1:FN9M2AhknQ6Bge7A51b
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aelibinf.dll

IMPHASH 22b98c5c8c68a5c45b232e3b1c1c06e3
SHA256 00da20e602fa16db217f0e947e810230bd9ddf859b902d32d9c1fde813be9f33
MD5 b871e50964730df56ba2782bcff46d97
SHA1 c50a71ed3cbd0c3a362b34d80e69260cfa67f1f8
SHA512 478f05df9dde5950b211ab3ceb14391352114d75de3abf80070ffe569bcd7b32f930f28321b9667b72933955db2f366f03892cef130780990ef85f438019ec2a
SSDEEP 768:VVH0SGm8JSMfeHbSUSGE3MSE+RenTksudO6mlGDOtnLiG0VtnDI37XKd0YI2HAKq:VVXUeHbxv89suQlAVtDD0YHgKvghR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7f:9c:b5:66:6d:4c:08:72:9d:51:f8:0b:bd:44:82:b9:cc:a2:3a:d9:c6:4a:92:3a:8c:4f:66:98:17:7e:6a:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 7, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

4b:e2:b3:6d:d3:ee:80:df:a2:f4:df:f5:4a:66:6f:b2:c6:37:15:4d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 7, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

14072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aelibinf_db.dat

SHA256 0544403357dbff7551fc17f348a446d556a094d6c42e1121eb337de3ff88ca5c
MD5 ddc132992273330ec506e63fae4985b4
SHA1 7bf3018217f136662c159994f6530edf4c976a10
SHA512 fd1233c02cfd72116b92833810db084c1caa08530cdc0626a1e2fe035236b29348fdb4d89192aa473dec5ece5694017f3a3a46eda7f87c20a89cd07132f4d122
SSDEEP 1536:NO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1w:dNzXDFjvM25o2iHMWMzPZ0i6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aelidb.dat

SHA256 ca5bb2f6c93eccc1ef5a2b2aae25b4976a2ce320a52d13d74f12b65205678e53
MD5 e12b4507919ef2d5b5f2b5332f7c2bb1
SHA1 4dd0c1870754a4052f9de5f09f69df3f7bae4b3d
SHA512 74a2e05077726ab00a810325d6be729c001f290977c9e4e3d81d3f4fe4398317698510a0bf5d5014625e5c740f11dc10cf004cac343cd1e4d8ab82908a0376ad
SSDEEP 1536:FO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1l:1NzXDFjvM25o2iHMWMzPZ0ib
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeml.dll

IMPHASH d45e3e670f326c83c96703480243c25f
SHA256 403866092dc4390df546399ee68ced2d1d1c0394b8769ef739fa7f240cefb385
MD5 3a200d0d84eb94f86868490c0261937b
SHA1 0563dd476b1d75195c164c6752276c0efc118081
SHA512 13416e2731006107500ee4c350e59b21897d42fd8e5cce18606a098be49fc24caa14b4e886bca995962920aac120316ae9e7d53688fac30022eeb2cbbbc88e63
SSDEEP 3072:/2TTkgqzVWX1P++4VTmlY7v/uoCi+X8QAVhy4ut5xZsmiVw:+TlP+HClYb/uoCF5ACCm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

03:79:58:e7:8e:dc:92:64:20:7f:59:66:0a:f3:4c:10:36:ea:1e:36:d6:47:cd:4c:47:f9:03:79:46:ce:cd:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 5, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

ad:a5:23:6e:4d:e4:26:44:61:8a:92:ca:02:d1:36:4b:f5:69:ba:1b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 5, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

54:09:d5:71:49:1d:e7:22:df:46:2f:a4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

50931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aemobile.dll

IMPHASH b9a9f12e7843764d45da446295f03e2a
SHA256 5096c9ab09e878d06596a20192d9b22ae7432bc660c8f4d8a24ea5daec509baf
MD5 ae3587d21cae5d74e438ee2492f65e72
SHA1 513ee522fb8e64312e99f1cc0b224bb315178532
SHA512 862e65c9122aa3f4d3155e995f586d13a93c5ccfaed6e637f34b5847bc178b80c9da51b9d9e3c3b03d61538ead7ad7ad03ab19e94a62f420da2ac62b7ceb060f
SSDEEP 6144:8NO19B3fnj21PJQs545pFFpMvqW7yCpPi+W25La9lIgUyff:8gvnj21Px5Ewq8LslF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

10:48:9b:f5:54:b9:cd:cb:20:aa:c7:7b:b5:7c:64:01:54:0a:d4:0b:74:54:eb:50:44:fb:e3:86:0c:64:bb:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Nov 9, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

c7:ac:83:4f:95:c4:ee:a6:d1:8a:93:84:16:87:20:d8:68:4a:fe:d7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 9, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

237696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeoffice.dll

IMPHASH 06ae0e1fd5b99dde689ae499a2670f2f
SHA256 1c2a0d870f46575dfece1758809ac4d7f5e37fdb945a874512f99f275c4d2bc0
MD5 ade1cd616758d98b6940bff8a327c719
SHA1 899e7c2ba09039056b17d2bba0ac87cd2a60c224
SHA512 ad3249022c85851dadb717b0d1249b02eff89002004b98afa56c48b8c3d4de84a3345e0db95d387aef467bf80fb9250c9d73b580092b480bd96210e939535cd8
SSDEEP 12288:y8AvzivsdXkMME5zFVtuEDJvv01s+uUoTrTPe6sT54c:bkGvsdXdxp61s+uUoTrTPe68
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

03:73:25:b1:03:33:3a:a7:28:3d:e3:e1:60:6d:65:b9:d7:88:6d:de:1a:96:16:e0:e4:8c:a1:d7:5f:d4:f4:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 26, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

86:07:da:45:9c:5d:69:5e:07:91:b1:25:66:91:71:61:37:56:14:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 26, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

447258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeoffice_gwf.dat

SHA256 96e2488023689abf71cf9b951548420ff3ad9d6ff37116d4279a43b5b736968b
MD5 0c95def0894c5e5716cf7a3ecc7545a6
SHA1 51ce428514d454e7a428d57e3e050c1edad93a20
SHA512 2884dfc79a869b3e2db3f62340dccd3cee7746852006f67a26a26a4716ec719ba196627b18ddd775655b7baf954f668e9b5229297a4b87685f087e693184b369
SSDEEP 768:y6NQXRQOmhg0jm0fbaakNk8AWdp/2cqMgMYD82ew4uT7jKq:y6NQQi0jfGakNbAGX5gP82h4Iqq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeoffice_mv.dat

SHA256 2b5481a0d65c9a80a708aac3cb0ab281cd601d1274caf11517d821dbcbb9b4f1
MD5 0ce7e54204f99ef637b05ab9d78be36e
SHA1 3641faf0e2c345e61de14d34753ed26e32e9de6e
SHA512 4ac98f69f3e9895510571d4b9952f63394cf8c1e34a4cf8a44a28b1cecc1f23fbbf245e831c2bcfa801f16735e4e16e6f3158f2dce2738a9701b6e97975125a2
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/aepack.dll

IMPHASH db61fd1ccd4070ba4964436e32dea996
SHA256 04936e1a579464228b0a04fe9b9808a2c94d60fd8f968261f8576ffb48ab8140
MD5 2d7f4f6b862c67d29f9acede3f87cf62
SHA1 cb205c9ab69ce9b11fd404c82278254e039391fd
SHA512 075501cd6a482b47b03c1c113246b3d9ed109966d9d944cc32708e60c4bdeddde562921f897a952341c9106b0794685d6638bd4505340b8079e75f0ea0bd5045
SSDEEP 24576:atz1KXoXhoY6pJ1LTwV969rMB0u604dHcUKP1Y4:atBBepJ1LH9BuxK0B
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

28:41:f2:33:e5:19:e0:55:f5:df:da:ca:63:57:d3:cf:ea:f4:7a:25:28:a9:1f:76:ed:53:42:11:5d:12:6c:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

9a:09:95:17:d4:5d:df:35:a9:c1:ef:10:49:0a:2d:f8:f1:bc:7b:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jul 27, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

687648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aerdl.dll

IMPHASH cc6d764effee6149756ba277acbb1c25
SHA256 f15ddc02864fce89707ec58b1f50ee5ab31be563da15d9d0e10c21746cb5f9cd
MD5 9b6b3cada9669f3b17ff9368f5f42148
SHA1 17a644be4542753bcebae09bff342c6e70e425cd
SHA512 3da00167dea05a34897ad17c236591b6dcb48bccd37ef2e29c52d15b8f5dd52cc53fe136129aab43ca39f2e5729746724ab9d4854cb021c298490a7c0ee5cc1d
SSDEEP 24576:amhFd3CHwCtScxrfKeDhYthlw/9X91UeF/0xR/1WoTikWa8a9gEng:2wCt2i/fmYQtDD9gEg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

24:4a:d6:5b:b2:f0:c6:f1:3b:f2:67:36:ba:27:0d:b8:ff:3f:33:f9:8a:a5:8d:39:d4:66:f2:87:8a:76:52:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

9b:e8:88:b0:f6:36:24:3e:1a:3d:85:d5:21:0e:5a:d2:0e:3e:d1:0d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Mar 2, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

923255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aesbx.dll

IMPHASH cc6d764effee6149756ba277acbb1c25
SHA256 1f568d08b101fa5407a56d9ce45c175be07796edd8db403f684f66a8ef492848
MD5 d984588795b6363c7166901e58b390d7
SHA1 8064803b24a58ccee1d472ec4138749ff917f20a
SHA512 1f5a8be0813ea0935de291d83aca412eb6b6de24729acd59aa55619c86d549ca9228b5586a3ea6c0b5490149fbadf0aad6d222434e248ae6c9f7609a1b4cc28a
SSDEEP 24576:Sj52e/EzQS+LZCBqn+eN6ZZn9cY+dnrwr91sQvjqr3:Co29SQMBeKEAHjW3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

10:db:f2:11:be:90:3f:f9:a3:0f:06:da:27:9d:50:cd:26:ab:b0:bf:d9:c4:1c:97:1c:67:c1:05:2a:da:0b:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

4c:59:90:55:60:0f:2a:72:fb:e5:e9:b1:d1:27:70:96:08:28:99:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Apr 2, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Serial Number

33:90:20:77:61:c4:26:dd:94:50:03:0d

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

1237134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aescn.dll

IMPHASH 44f9d837c62b89ef72663c75c40b9031
SHA256 6cbed7d2bfb842203cf05c9f43ad19280cafae9e5a40e846ad3844cf1d55d5d5
MD5 214b4c28771c952c5ceaa78803e0b6f5
SHA1 82c89b31860022e638ecd0aa08a87ec6c5c96cec
SHA512 cc2fecff4f8142ebc42db9771626ef7a4968f29a9cc70b26f6e4ee39e9684496ea65a5d19cc921b9c4aac63655d1698d076f44aab1eda01374b3e9a6255ddec2
SSDEEP 3072:olqZ5qxwY7ETXqPuKaJ7r9cGE9quTX4kp78kkp3tM5JG0YfF:sXxwYQGPl27xLoTom78tKGvfF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

90:43:b4:95:43:c9:cd:76:e7:e4:ad:9d:75:38:da:d4:86:e1:36:8b:7d:73:b8:2a:e3:8d:d4:fc:0a:45:bf:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 21, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

9a:0f:be:ab:27:ec:48:0c:ad:eb:00:d8:e1:59:a7:8c:27:e1:a0:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jun 21, 2020

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

ab:dd:67:65:f2:5a:ef:50:00:00:00:00:55:91:e9:0c

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 5, 2018 - Jan 5, 2030

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Minor OS version

0

Major OS version

4

Entry point

81889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aescript.dll

IMPHASH 9092dce3db7eacf36a41cb0b197c84da
SHA256 aba35f27e9285a17f9163c293cc666001302da3035f7791d032333dd41adbe86
MD5 0e93caf3c61398ebb511f711cc013e0c
SHA1 4a1ae4321ec388010d2f27434f6ee46f0b2f284e
SHA512 25a1d0f7fae2af6cac8b8f2cba25c348df243913352e8eccee0971c33cba9d20e6d83eb5595cbbfafb13c2dc0d75f2f6204005eb8d8a3e68dd0eacaec86f39a4
SSDEEP 24576:HCZQ3dK/6iapCIQJL81tQnHAY3R5VmSrM1/YI:iVuaJUtlYnASg+I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

49:98:54:7f:65:6e:99:2f:97:74:cb:e8:e5:40:fc:9c:6b:f7:86:65:98:97:97:9b:1b:ab:cf:96:6f:94:45:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 19, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

7b:9e:b3:f5:65:33:b6:0e:d0:29:f5:75:69:d7:ee:a8:87:4d:af:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Aug 19, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

0

Major OS version

4

Entry point

968956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeset.dat

SHA256 2b897418cb59d00a89890c8c4c264ed383a24bf319b27043862ef952dee9a132
MD5 4c9ed5bf916808f45ee25456f977f4b6
SHA1 bc3101b75755a91ee25b757c547c59b998deecc8
SHA512 21bdd8790afb37417119782c46c6caf6789d79fd2ed04959f546028518ba29183be6bde4fa76a8da66e1656bc9b339e3f8c0f9b46eb77c77c26fea0fcee64fb3
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/aevdf.dat

SHA256 4a12d2dbdea0ec6c98041ab78180e724be4ff5a441f5206a4d5b4bdf95c94963
MD5 a5061efe8e4dce49b7ac121b739e81c8
SHA1 b84a451c5ea7bb9b3ed14102341f9adff77d7d24
SHA512 dff902584971d28f58129edb2179c1a552c74541b23a9abc67924c0101cc3646c1df36d1738074dc4572d79db8cf08a053a7e2b3dcb18b6c1364766ea61dd605
SSDEEP 48:IZundhvs1U9JYcLaefVx7VL3CiV+35vnBvtpm5Mf/pLt3lREyAz6OFvbewRLIMwu:IZ8E1yaSVLOPOy5Qz6YeZLct7LGSkW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aevdf.dll

IMPHASH dbd46f388a9ed1e1a79f4f4b84c4df08
SHA256 d3d2ab463a7a8e014baa9380688db62bbde9a8ecc93c78206660d080636cff34
MD5 7a485eb8029ebcae86880bd41696627d
SHA1 5be46514383b6c736983a638896d57d363cdea21
SHA512 1d50c941247d08acd4a35852b2ba568713c3da2bbc91b682163066a3ce9a4fbe6530b138c187a6297237984f664f23755bac6e74432aeae0734defa128088f6e
SSDEEP 3072:g+rd2qTZPVeonYjc0FMTslGrLsyj072fin/2RBB9Zaa0cmc8o/7tRN397osFZP:gOdZVewL0rNozBKQZP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ff:96:bc:db:a1:13:8e:48:f1:2b:ed:c2:c7:53:92:d4:9e:35:cf:76:c6:b7:90:be:72:0a:5b:bf:78:fa:fa:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 18, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

35:ab:2d:a1:43:89:a9:be:c8:f8:8f:e8:7e:f5:fe:3f:bf:3d:dd:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Dec 18, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

70314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/ams_setup.exe

IMPHASH b64e0d1107195a70b1f4b66a4095b2f4
SHA256 b28a92c1c971084a56fd71427e79ce08f5c504f13f4a78b39a6f75934156aed4
MD5 35f0a69eb13ff2c63722260091f1b220
SHA1 eb90188636d41ec44d2863ad5beb669ef25c7311
SHA512 d4e0362957d929325805bbb744789f0232ae4fb1710e202f04d757194d0d4194b1fe42fa93e5285e44f1945da85b24c55a812b484f5767303d2759d7b21da143
SSDEEP 3072:pb3raqcRjNrZoHmPlREYkLLaslQOM+FFSLJAK36ouukFYWoBT/WUURO9XZvTiJcg:pTetoHmLEzLLXQFmiD3idUJXZ+cg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

20:ba:2a:c1:4c:06:e0:6e:5e:80:c2:55:bc:b3:ff:6c:51:cf:f8:d3:90:3e:21:2c:a3:dd:da:08:84:03:fc:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

1

Major OS version

6

Entry point

29152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\utils\aviraoa\ams_setup\ams_setup.pdb

shlwapi

PathFileExistsW PathRemoveFileSpecW

user32

GetSystemMetrics ExitWindowsEx MessageBoxW

kernel32

CreateFileW WriteFile CopyFileW SetEnvironmentVariableW GetCurrentProcess GetBinaryTypeW HeapAlloc GetSystemTime GetProcessHeap GetEnvironmentVariableW GetFullPathNameW MoveFileExW SetFilePointerEx GetFileSizeEx LoadLibraryW FreeLibrary GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess WaitForSingleObject CloseHandle FindNextFileW FindFirstFileW FindClose DeleteFileW GetProcAddress GetModuleHandleW GetNativeSystemInfo LocalFree GetModuleFileNameW GetLocalTime GetLastError GetCommandLineW ReadFile ReadConsoleW HeapSize HeapReAlloc DecodePointer SetEndOfFile WriteConsoleW HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetStdHandle ExitProcess GetModuleHandleExW LCMapStringW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW

shell32

CommandLineToArgvW

advapi32

SetServiceObjectSecurity BuildExplicitAccessWithNameW SetEntriesInAclW QueryServiceObjectSecurity DeleteService CreateServiceW ChangeServiceConfig2W ChangeServiceConfigW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegQueryValueExW RegDeleteKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle FreeSid CheckTokenMembership AllocateAndInitializeSid

SAVAPI/amswsccomm.dll

IMPHASH 90ca7a861c86e1e6d3fb23c54f549f2e
SHA256 8aa0e77fd794e5abb38daececff9334219499d32aded8a6304382d93ce07377d
MD5 1cef8dc4a1bc013e2072380f0c05fa85
SHA1 26a3144d6c5a5fe11b9276b34b4ddde70fe8391f
SHA512 eadb7a85d89b295f8d981da4c7f5be1b400c8ed8734fd70b5eac6fb8e79c8281371a0a57e056dfd820ba8279fa5e0c3ec25fb270a4ae8d9387ef5d4229f01cab
SSDEEP 12288:JnTfgEFlrP4SYxhdE77TsXOQtiUTSLxk1gH9JVbkX3b:JnTnFlrPlYxbGaOQtVTmk1i9Ja
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

e8:c9:2c:bf:bf:44:89:5d:57:50:3c:97:d7:b1:e6:0f:fc:2a:2f:89:ca:1e:51:ee:7e:aa:d8:8a:a5:4a:58:8a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 4, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

1

Major OS version

5

Entry point

50373

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\5x_rwgif\common\amswsccomm\libamswsccomm.pdb

shlwapi

PathFileExistsW

kernel32

ReadFile WriteFile CloseHandle CreateFileW PeekNamedPipe Sleep GetSystemTime WriteConsoleW HeapSize GetLastError GetCurrentThread FlushFileBuffers GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer QueryPerformanceCounter CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEvent WaitForSingleObjectEx SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RaiseException RtlUnwind GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW GetFileType GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetEndOfFile SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetStdHandle GetTimeZoneInformation IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetCurrentDirectoryW GetFullPathNameW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW

crypt32

CryptProtectData CryptUnprotectData

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

SAVAPI/apc_random_id_generator.exe

IMPHASH b1ef39e19e7edc44a55fb07e315cf760
SHA256 b01a44e0fb9e01ffc4446d60736ff784d8ada511484e107bad1e66d3cc1d59a8
MD5 ceee905a278dc72f407b4af32366089d
SHA1 3a16c14eb27fdc8ff93a5123b45bb599f4762925
SHA512 519496fb33db80456eddbf3601018735da58855a88d01b17f04043c4f542c28b7ba5bc61b9a9314934ebd00c4b09d9b2b1e8d4f12e3cff1679fb0191e72c4b89
SSDEEP 6144:aLL+IGzcYlBZbld+Hcso5fLuUZdvXwDwY4khotAKyjH6S9uuLH2JDsQ8cNdkhB:aLL+IGzcoBZbldJJ7XwDwY4khotAKdSP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

6f:7d:e8:5d:bd:2b:83:60:48:ca:42:cb:1a:b4:79:dc:7b:e4:22:27:cb:6b:34:4a:b7:f7:65:80:4e:29:91:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 28, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 2, 2021 - Mar 6, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

122384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\r5hd573d\utils\apc\random_id_gen\apc_random_id_generator.pdb

ws2_32

accept getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername WSAGetLastError socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind ntohl

rpcrt4

UuidCreate

kernel32

ReadConsoleW GetConsoleMode LCMapStringW CompareStringW SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime GetLastError LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection EnterCriticalSection GetConsoleCP TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetStdHandle GetHandleInformation SetHandleInformation WaitForMultipleObjects GetCurrentProcessId GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW WriteConsoleW CreateFileA GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue GetVersionExA GetModuleFileNameA GetProcAddress LoadLibraryA SetEndOfFile LockFile LockFileEx UnlockFile UnlockFileEx DuplicateHandle GetCurrentProcess CreatePipe CreateNamedPipeA FormatMessageA SetFilePointerEx HeapReAlloc DecodePointer FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap HeapSize LeaveCriticalSection CreateHardLinkW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW RaiseException GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid

SAVAPI/apcfile.dll

IMPHASH 09581c73a9cfd8879440aa7e36eb5df9
SHA256 042048cdcba5647c8ba28fe682e0d6eda5543220fdcedd6908527f339441cd81
MD5 f1eea993b439b952f46948021fe8a2de
SHA1 f62b8626bd1799c85b94743e0278d2b01b60de95
SHA512 817e763ed7f13b020d3f9f345e708eface3e4227ab57ce30f5bddf1f2f1cf7ce2ae82ebfb3ac3c20ba08d7b009d92bcc07d68c5c3fc2d0afedc0cdaebc4023c7
SSDEEP 49152:wwqo4YFwoDpGgg7anyhBE4KJXW4GezlmqelpnbcDHI1SP0kootlFHopCb1XKc:wwqoFwJgg7anyhBEZkpMl3elpbcDHeQp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

9b:94:35:b9:f2:6c:15:ec:b8:d5:c3:f0:aa:c1:88:e5:a5:10:aa:3e:2e:00:76:81:5a:20:2c:1e:b2:6d:17:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

1

Major OS version

6

Entry point

1969736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\utils\apc\sdk\sdk\src\build_apc-build\bin\apcfile.pdb

netapi32

NetApiBufferFree NetUserEnum

ws2_32

inet_addr WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getservbyname shutdown ntohl getnameinfo gethostname freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError setsockopt ntohs htons getsockopt getsockname getpeername connect bind inet_pton send recv WSAGetLastError socket closesocket

mswsock

TransmitFile

rpcrt4

UuidCreate

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

kernel32

SetConsoleCtrlHandler GetModuleFileNameW ExitThread WriteConsoleW SetEnvironmentVariableW GetConsoleCP SetFilePointerEx HeapFree HeapAlloc GetDateFormatW GetTimeFormatW FreeLibraryAndExitThread GetCurrentProcessId GetModuleHandleW GetProcAddress GetCurrentProcess GetVersionExW GetLocaleInfoA GetLastError SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetTickCount Sleep MoveFileExA CloseHandle WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoA GetEnvironmentVariableW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageW GetFileType WriteFile SwitchToFiber DeleteFiber CreateFiber LoadLibraryW ConvertFiberToThread ConvertThreadToFiber FindClose FindFirstFileW GetSystemTime SystemTimeToFileTime GetACP GetOEMCP SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation InitializeCriticalSection TryEnterCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA DuplicateHandle SwitchToThread GetCurrentThread ReleaseSemaphore CreateSemaphoreA ResetEvent FindFirstFileA GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetStdHandle CreateFileW DeleteFileW SetFilePointer GetOverlappedResult CancelIo MoveFileExW CreateHardLinkW CreateDirectoryW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GlobalFree SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile PeekNamedPipe SetHandleInformation GetSystemInfo MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileA GetVersionExA GetModuleFileNameA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwind HeapReAlloc OutputDebugStringW IsValidCodePage FindFirstFileExW GetCommandLineA GetProcessHeap HeapSize CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes VirtualAlloc VirtualProtect VirtualFree InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx FindNextFileW DeviceIoControl GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW EncodePointer DecodePointer RaiseException GetStringTypeW CompareStringW LCMapStringW

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource

bcrypt

BCryptGenRandom

apc_add_cache apc_authenticate apc_category_name apc_create_context apc_ctx_get_file_lookup_filter apc_ctx_get_user_data apc_ctx_set_connection_timeout apc_ctx_set_data_timeout apc_ctx_set_file_lookup_filter apc_ctx_set_upload_connection_timeout apc_ctx_set_upload_data_timeout apc_ctx_set_user_data apc_disable_logging apc_enable_logging apc_file_auth_checker_callback_set apc_file_cache_disable apc_file_cache_enable apc_file_cancel_uploads apc_file_check_file apc_file_check_files apc_file_check_files_ex apc_file_check_hash apc_file_check_hash_ex apc_file_check_hashes apc_file_check_hashes_ex apc_file_ctx_call_filters apc_file_ctx_get_elf_mode apc_file_ctx_get_ext apc_file_ctx_get_ext_policy apc_file_ctx_get_filters apc_file_ctx_get_mac_mode apc_file_ctx_get_pe_mode apc_file_ctx_hash apc_file_ctx_set_elf_mode apc_file_ctx_set_ext apc_file_ctx_set_ext_policy apc_file_ctx_set_filters apc_file_ctx_set_fops apc_file_ctx_set_mac_mode apc_file_ctx_set_pe_mode apc_file_ctx_set_temporary_dir apc_file_hash apc_file_hash_ex apc_file_info_get_extra_info apc_file_info_get_malware_name apc_file_initialize apc_file_initialize_context apc_file_metadata_set_download_url apc_file_quota_callback_set apc_file_set_batch_service apc_file_set_temporary_dir apc_file_set_upload_threadpool_limits apc_file_uninitialize apc_file_uninitialize_context apc_file_unwilling_to_upload apc_file_wait_for_uploads apc_file_willing_to_upload apc_free_context apc_get_file_lookup_filter apc_get_library_version apc_load_cache apc_save_cache apc_set_cache_dump_secure apc_set_connection_retries apc_set_connection_timeout apc_set_data_timeout apc_set_file_lookup_filter apc_set_low_upload_speed_limit apc_set_low_upload_speed_time apc_set_max_cache_size apc_set_max_upload_speed apc_set_metadata_product_id apc_set_metadata_product_language apc_set_metadata_product_license apc_set_metadata_product_random_id apc_set_metadata_product_version apc_set_out_of_memory_handler apc_set_proxy apc_set_proxy_auth apc_set_server_message_cb apc_set_service_address apc_set_ssl_ca_cert apc_set_ssl_crl apc_set_upload_connection_retries apc_set_upload_connection_timeout apc_set_upload_data_timeout apc_ssl_threads_initialize apc_ssl_threads_uninitialize apc_strerror

SAVAPI/apchash.dll

IMPHASH 8ea6ceb7eea753a493da5f19453ffe74
SHA256 5e935a9ccd8458312a22b26b4a726861567376ee3d82d4255a03f3efb84f59e1
MD5 7a380e745b99473911cc6bd0e0fd1743
SHA1 3e2c3f7c34025f358f2cf963ab02eb8e1fd3ebfa
SHA512 be5188a38ce107d4d4f500bc5e2a0fcc9f5dbba73938d68c2278af42ef15e1b1a282c05f56a6db265b24a35ed109e724e82a0a329e3fd24ab615dae80ee52303
SSDEEP 3072:oyIIII79fgE9rzlJhSeVv1bT/NqjXG4wBfJVbrfWzSFbrzRTCoEEbNPCs8ywd6:zIIII797dJgUFqDUmz4vzyE89M
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

3f:d1:89:bc:e9:9c:cf:62:98:90:d6:25:da:69:b7:0a:3e:88:d4:64:06:72:90:bb:88:c0:5c:27:54:b7:b4:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

30424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\utils\apc\libapc_hash\apchash.pdb

SAVAPI/avupdate-savapilib-engine.conf

SHA256 5c073f2195c20ba9e30e9013f99d1461b7e12d34a3920fc96f4877c9c44ea5da
MD5 5410d22ecaf5de79e5bc31d298b20c90
SHA1 1656b8e2ca74a4fcaad70859c113abf30a3aadaf
SHA512 d47edb1660d1ac5104462d8f2a52b1549814beeaa12fe30bb54350a0e10405b6fcf13dd709b25b730e590b1ada88ba0105644d32dcd7f958a0c67aaf9078101d
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate.exe

IMPHASH 98391639ecf68510bcf6270cbf1d9dce
SHA256 d83f9e625f5756775a6c737426d4408af9d77d03f812850ebb096a4127f832d5
MD5 1fe10e77dfbb3d61c694d2ebe19ecf3f
SHA1 8380157b09c578b13536887a94e3a5a927f2b2ae
SHA512 7c1159ed9a81786d76312ae50624029ad0ba436a7e20f78af610cda59c483897b7b74c8a1ececfdce5ce1dc8d89abdc5ed28e38986f5e0a3ef99640636a818eb
SSDEEP 49152:X8vIWDYXCsWpXC+cWgg7anyhBZ31oEiiojQ7TWh3zdPCDo3rD62eLV:X8vfYXxWpXlgg7anyhBZaEiiojbpzcD1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1d:fc:41:fd:fe:3e:1e:d8:04:fd:c4:4e:db:c2:0f:a2:47:9f:bb:88:3e:9b:29:ec:3e:44:cf:7d:90:50:a6:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 26, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

2007284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\fe4_3woi\updater\avupdate.pdb

scew

scew_element_by_name scew_strcmp scew_element_attributes scew_element_children XML_Parse scew_list_next scew_list_data scew_element_attribute_by_name scew_parser_ignore_whitespaces scew_parser_free scew_parser_create scew_tree_set_root scew_tree_create scew_attribute_value scew_attribute_name scew_element_add_attribute_pair scew_element_add_element scew_element_add scew_element_count scew_element_set_contents scew_element_free scew_element_create scew_tree_root scew_element_contents scew_element_name scew_tree_free

ws2_32

closesocket WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getservbyname ntohl getnameinfo shutdown gethostbyname gethostname freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket inet_addr recv send setsockopt ntohs htons getsockopt getsockname getpeername connect bind inet_pton WSAGetLastError

mswsock

TransmitFile

rpcrt4

UuidCreate

shell32

CommandLineToArgvW SHGetFolderPathW

mpr

WNetAddConnection2W WNetCancelConnection2W

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptCreateHash OpenProcessToken GetTokenInformation LookupAccountSidW SetThreadToken DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegCloseKey CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash GetUserNameW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW ReportEventW RegisterEventSourceW DeregisterEventSource

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

SetEvent TryEnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW WaitForMultipleObjects InitializeCriticalSection GetHandleInformation SetEndOfFile SetEnvironmentVariableW SetFileTime SetFileAttributesW GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindFirstFileA CreateEventA PeekNamedPipe CreateSemaphoreA CancelIo DeviceIoControl SetFilePointer GetFileInformationByHandle DeleteFileW SetStdHandle LoadLibraryExW SetErrorMode RemoveDirectoryW CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFullPathNameW DuplicateHandle SwitchToThread GetCurrentThread CreateFileA GetVersionExA GetModuleFileNameA LockFile ReleaseMutex UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EncodePointer RaiseException ExitProcess GetModuleHandleExW SetConsoleCtrlHandler CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleCP WriteConsoleW GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc GetDriveTypeW GetDriveTypeA GetCurrentDirectoryW SetCurrentDirectoryW ConvertThreadToFiber ConvertFiberToThread CreateMutexA LockFileEx ReleaseSemaphore DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetStringTypeW GetProcessHeap ReadConsoleInputW FlushFileBuffers FreeLibrary GetLastError GetLocaleInfoW MoveFileExW LocalFree FormatMessageW CreateFileW ReadFile CloseHandle SetHandleInformation CreateNamedPipeW GetOverlappedResult ResetEvent WaitForSingleObject CreateEventW TerminateProcess GetExitCodeProcess CreateProcessW HeapSize GetProcAddress LoadLibraryW GlobalFree GetCurrentProcessId OpenProcess GlobalAlloc GetComputerNameW GetVersionExW GetCurrentThreadId GetModuleFileNameW GetModuleHandleW GetCurrentProcess GetSystemDirectoryW GetWindowsDirectoryW IsWow64Process LoadLibraryA MultiByteToWideChar SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA QueryPerformanceCounter GetTickCount Sleep WideCharToMultiByte MoveFileExA WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoA GetTimeZoneInformation CreateHardLinkW GetACP GetOEMCP GetStdHandle GetConsoleScreenBufferInfo GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW GetSystemTime SystemTimeToFileTime GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW GetFileType WriteFile

bcrypt

BCryptGenRandom

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

SAVAPI/avupdate_msg.avr

SHA256 aa245a1518edd42f88f17b943a4d128810b1d371b09ca49d1b17ca36bc4a1727
MD5 99a82442c65cb314838ccd27db19a51f
SHA1 f77a75f07695dae310e6f05816c21ecf3aa54b08
SHA512 d8a2601a049eac4237d2ed65eea4fa5a808ba3288fe5795b0235ae574dffa20b84dd39d64344e778615265621545b7ccd07943fccd9892bd94b53ea9cd401b89
SSDEEP 96:7+rz/vx3SFRuC9nNKZRllhXBpQisZ3i5hSAFCLYIFrGZk2Z+5ZDSLW2vnv13Srv7:qiFRuCJNKzRxw3i5hSAIbyrZ+7wnU7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/cacert.crt

SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
MD5 9956b172b62aeb41ca988999947a488e
SHA1 199e3607abeafd168b02b062697656a847fe4de7
SHA512 5d365e0b88a15b43bf84650f0e98bb05fd6e0257cbd73b2227bc27b94cad3086df2a65fa227ddfdf484447d91297c48800a1ed111a6bc880da53195b8657f189
SSDEEP 96:LrBwgYufFy6nfwJeMmFtBuyuCk+Plvz49wC5UnhVhdnZrYGjWwbhliiuD:HBwgY2FLfFpbunCXlv09wfnXhNZrXxfq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/elam_ppl/AMSAgent.exe

IMPHASH 2157780a8f0ae11fe3cdbf455db7e287
SHA256 429092df22f0312932d79529a872494cb271888c80de8522b4186b4005775d40
MD5 a3deb4d720484b67ea8e417cbf3e98b8
SHA1 1f8b3152397812ccdb2db9a1aca756aef68d3e74
SHA512 c1ab72eb11bf9c3a51c78b16e665c5922881be3de4b7caf31612b65411b648adfe90c6b1a41208bc81f37242ad56035c6ed0ab08fcce5f458de4b24eeb579167
SSDEEP 24576:FrJssaNT1+u+dM5ELn7XS6bW9eKKce1THOhqt2IoeVMP/P+QQ4yv:FrJsFNQuB5EL7XSeROqt2IP8/PpQ4yv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

4c:91:52:e4:ed:ed:60:25:e8:18:1f:77:f1:ba:48:f3:9a:3e:08:17:c6:05:c8:01:38:f1:57:98:3a:b9:b9:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

387591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV-BARW\AV\BuildOutput\Bin\Release\amsagent.exe.pdb

kernel32

OpenProcess FreeLibrary GetProcAddress LoadLibraryW K32GetModuleFileNameExW K32GetProcessImageFileNameW CompareFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation WideCharToMultiByte GetDateFormatW GetTimeFormatW GetLocaleInfoW GetSystemDefaultUILanguage GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection UpdateProcThreadAttribute InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer GetCPInfo TryEnterCriticalSection CompareStringW LCMapStringW SetEvent ResetEvent IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess InitializeSListHead OutputDebugStringW WriteConsoleW SetEndOfFile HeapSize CreateProcessW GetCurrentThread GetExitCodeProcess GetCurrentProcessId GetCurrentProcess WaitForSingleObject GetProcessHeap HeapAlloc CloseHandle QueryDosDeviceW CreateFileW FormatMessageW LocalFree MultiByteToWideChar GetModuleFileNameW DecodePointer GetTickCount64 Sleep GetLocalTime DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException SetLastError SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetConsoleCtrlHandler ReadConsoleW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlUnwind GetDriveTypeW GetFullPathNameW ExitThread ResumeThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapFree GetFileType HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetCurrentDirectoryW GetCurrentDirectoryW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx RtlCaptureStackBackTrace

user32

UnregisterClassW

advapi32

ChangeServiceConfigW StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenThreadToken OpenProcessToken TraceMessage

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoInitializeSecurity

shell32

ShellExecuteExW

oleaut32

VariantInit SysStringLen SysFreeString SysAllocString VariantClear SysAllocStringLen

SAVAPI/elam_ppl/AMSProtectedService.exe

IMPHASH 78381432291e84e8d63e36c28bde989c
SHA256 98fcbacccd356a5309626a0cfd398702f5f2b582e0ceddbc8aab55dac1a0271d
MD5 831dd67d23fd157956b010ac05f1b162
SHA1 f509362297d79f85a25e66df5cfd720bd3fe3cf0
SHA512 b044ad38f78a15eb387654f653524987aaf82371e47558d947b7d0cc8910dc22d750fdded549fb9931c7318012ca1afd437394f00d976bf938116d3e469b99e4
SSDEEP 12288:k7NMkvTvIrlhqbfYHdled/51eqrNXF7+yHdnjLv0JvNQsHskP5U6Bo1+N00KX+l:k7NLQx8bfYHbedR1eqBXUSlv0JNTMkP3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

b6:47:ad:f5:a4:0a:72:0e:4c:26:81:08:ba:aa:85:15:0b:23:eb:86:cd:fb:e8:fd:28:58:3e:0f:10:d1:4d:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

1

Major OS version

5

Entry point

197044

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV-BARW\AV\BuildOutput\Bin\Release\amsprotectedservice.exe.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime UpdateProcThreadAttribute SystemTimeToFileTime GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte GetDateFormatW GetTimeFormatW GetLocaleInfoW SetEndOfFile CreateProcessW GetCurrentThread GetCurrentProcessId GetCurrentProcess CreateFileW FormatMessageW LocalAlloc CreateThread WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent GetProcessHeap HeapFree HeapAlloc CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe CloseHandle WriteFile ReadFile FlushFileBuffers GetCurrentDirectoryW GetModuleFileNameW WriteConsoleW HeapSize ReadConsoleW SetStdHandle SetEnvironmentVariableW GetLastError FileTimeToSystemTime CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP GetStringTypeW QueryPerformanceCounter WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread TryEnterCriticalSection SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetFileType GetFileSizeEx SetFilePointerEx GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CloseServiceHandle RegSetValueExA RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey AllocateAndInitializeSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW SetEntriesInAclW QueryServiceConfig2W OpenServiceW OpenSCManagerW ChangeServiceConfig2W

crypt32

CryptUnprotectData CryptProtectData

SAVAPI/elam_ppl/concrt140.dll

IMPHASH 9119c3c59302a28e52b3bffe18f55f1d
SHA256 6567e9d90e91c3a146f1b9b6f30b2ab6ba04df11991647941b750bc141a718c0
MD5 cbaa2b13d56ebe7426e7d705e68bc0a1
SHA1 a866f6d22156b3628a7178cc72fc9f7e1dd94614
SHA512 b637a48144160b08fdd2c5f8702224e73a89cbacccef2e3f3190118f375285498161f680f66239de99d1fa0d75a86e95592f5386ff36e401c1fad6b1ff438b90
SSDEEP 6144:t2ALMk1VUyYI1hG3QYFruh7o/ehe1fjpsRV8JC0yD7+Rk6WvbZLl12z/gulAL:K8inIe1f2P7nFSz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

05:69:ad:d9:b5:61:3c:5d:3c:d6:42:75:4e:b9:87:71:99:61:a2:44:01:e4:8c:8c:60:47:59:76:e8:3d:71:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

169440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin\i386\\concrt140.i386.pdb

msvcp140

__crtCloseThreadpoolWait ?_Xbad_function_call@std@@YAXXZ __crtSetThreadpoolWait __crtCreateThreadpoolWait __crtCloseThreadpoolTimer __crtWaitForThreadpoolTimerCallbacks __crtCreateThreadpoolTimer ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z __crtSetThreadpoolTimer __crtCreateSemaphoreExW __crtGetCurrentProcessorNumber __crtFlushProcessWriteBuffers __crtGetTickCount64 __crtCreateEventExW __crtInitializeCriticalSectionEx ?_Throw_C_error@std@@YAXH@Z _Cnd_broadcast _Cnd_wait _Cnd_destroy_in_situ _Cnd_init_in_situ _Mtx_unlock _Mtx_lock _Mtx_destroy_in_situ _Mtx_init_in_situ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ __crtFreeLibraryWhenCallbackReturns

vcruntime140

_purecall __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memset __uncaught_exception memcpy __RTDynamicCast _except_handler4_common __std_type_info_destroy_list __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_cexit _initialize_narrow_environment _initterm_e _seh_filter_dll _initterm _invalid_parameter_noinfo_noreturn _configure_narrow_argv _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit terminate

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

api-ms-win-crt-math-l1-1-0

_CIsqrt _CIexp

api-ms-win-crt-string-l1-1-0

wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __stdio_common_vswprintf_s fflush __acrt_iob_func

kernel32

SetLastError DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait Sleep GetCurrentThreadId GetCurrentProcess WaitForSingleObjectEx SetEvent GetLastError DuplicateHandle CloseHandle GetCurrentThread CreateTimerQueue QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetProcAddress GetNumaHighestNodeNumber DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread FreeLibrary GetThreadTimes OutputDebugStringW LoadLibraryW LoadLibraryExW GetModuleHandleW EncodePointer UnregisterWaitEx ReleaseSemaphore InitializeSListHead SetProcessAffinityMask VirtualFree VirtualProtect VirtualAlloc GetVersionExW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask

??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z ??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z ??0SchedulerPolicy@Concurrency@@QAA@IZZ ??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z ??0SchedulerPolicy@Concurrency@@QAE@XZ ??0_Cancellation_beacon@details@Concurrency@@QAE@XZ ??0_Concurrent_queue_base_v4@details@Concurrency@@IAE@I@Z ??0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@ABV_Concurrent_queue_base_v4@12@@Z ??0_Condition_variable@details@Concurrency@@QAE@XZ ??0_Context@details@Concurrency@@QAE@PAVContext@2@@Z ??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_ReaderWriterLock@details@Concurrency@@QAE@XZ ??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_ReentrantLock@details@Concurrency@@QAE@XZ ??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_Runtime_object@details@Concurrency@@QAE@H@Z ??0_Runtime_object@details@Concurrency@@QAE@XZ ??0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_SpinLock@details@Concurrency@@QAE@ACJ@Z ??0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@XZ ??0_Timer@details@Concurrency@@IAE@I_N@Z ??0agent@Concurrency@@QAE@AAVScheduleGroup@1@@Z ??0agent@Concurrency@@QAE@AAVScheduler@1@@Z ??0agent@Concurrency@@QAE@XZ ??0bad_target@Concurrency@@QAE@PBD@Z ??0bad_target@Concurrency@@QAE@XZ ??0context_self_unblock@Concurrency@@QAE@PBD@Z ??0context_self_unblock@Concurrency@@QAE@XZ ??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z ??0context_unblock_unbalanced@Concurrency@@QAE@XZ ??0critical_section@Concurrency@@QAE@XZ ??0default_scheduler_exists@Concurrency@@QAE@PBD@Z ??0default_scheduler_exists@Concurrency@@QAE@XZ ??0event@Concurrency@@QAE@XZ ??0improper_lock@Concurrency@@QAE@PBD@Z ??0improper_lock@Concurrency@@QAE@XZ ??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_attach@Concurrency@@QAE@XZ ??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_detach@Concurrency@@QAE@XZ ??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z ??0improper_scheduler_reference@Concurrency@@QAE@XZ ??0invalid_link_target@Concurrency@@QAE@PBD@Z ??0invalid_link_target@Concurrency@@QAE@XZ ??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z ??0invalid_multiple_scheduling@Concurrency@@QAE@XZ ??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z ??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ ??0message_not_found@Concurrency@@QAE@PBD@Z ??0message_not_found@Concurrency@@QAE@XZ ??0missing_wait@Concurrency@@QAE@PBD@Z ??0missing_wait@Concurrency@@QAE@XZ ??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z ??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ ??0operation_timed_out@Concurrency@@QAE@PBD@Z ??0operation_timed_out@Concurrency@@QAE@XZ ??0reader_writer_lock@Concurrency@@QAE@XZ ??0scheduler_not_attached@Concurrency@@QAE@PBD@Z ??0scheduler_not_attached@Concurrency@@QAE@XZ ??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z ??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@J@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z ??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0unsupported_os@Concurrency@@QAE@PBD@Z ??0unsupported_os@Concurrency@@QAE@XZ ??1SchedulerPolicy@Concurrency@@QAE@XZ ??1_Cancellation_beacon@details@Concurrency@@QAE@XZ ??1_Concurrent_queue_base_v4@details@Concurrency@@MAE@XZ ??1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@XZ ??1_Concurrent_vector_base_v4@details@Concurrency@@IAE@XZ ??1_Condition_variable@details@Concurrency@@QAE@XZ ??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_SpinLock@details@Concurrency@@QAE@XZ ??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ ??1_TaskCollection@details@Concurrency@@QAE@XZ ??1_Timer@details@Concurrency@@MAE@XZ ??1agent@Concurrency@@UAE@XZ ??1critical_section@Concurrency@@QAE@XZ ??1event@Concurrency@@QAE@XZ ??1reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock@critical_section@Concurrency@@QAE@XZ ??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@$$QAV012@@Z ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@$$QAV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z ??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z ??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ ??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ ??_F_Context@details@Concurrency@@QAEXXZ ??_F_Scheduler@details@Concurrency@@QAEXXZ ?AgentEventGuid@Concurrency@@3U_GUID@@B ?Alloc@Concurrency@@YAPAXI@Z ?Block@Context@Concurrency@@SAXXZ ?ChoreEventGuid@Concurrency@@3U_GUID@@B ?ConcRTEventGuid@Concurrency@@3U_GUID@@B ?ConcRT_ProviderGuid@Concurrency@@3U_GUID@@B ?ContextEventGuid@Concurrency@@3U_GUID@@B ?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z ?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ ?CurrentContext@Context@Concurrency@@SAPAV12@XZ ?Detach@CurrentScheduler@Concurrency@@SAXXZ ?DisableTracing@Concurrency@@YAJXZ ?EnableTracing@Concurrency@@YAJXZ ?Free@Concurrency@@YAXPAX@Z ?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ ?GetExecutionContextId@Concurrency@@YAIXZ ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ ?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z ?GetProcessorCount@Concurrency@@YAIXZ ?GetProcessorNodeCount@Concurrency@@YAIXZ ?GetSchedulerId@Concurrency@@YAIXZ ?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ ?Id@Context@Concurrency@@SAIXZ ?Id@CurrentScheduler@Concurrency@@SAIXZ ?IsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ ?LockEventGuid@Concurrency@@3U_GUID@@B ?Log2@details@Concurrency@@YAKI@Z ?NFS_Allocate@details@Concurrency@@YAPAXIIPAX@Z ?NFS_Free@details@Concurrency@@YAXPAX@Z ?NFS_GetLineSize@details@Concurrency@@YAIXZ ?Oversubscribe@Context@Concurrency@@SAX_N@Z ?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B ?PPLParallelForeachEventGuid@Concurrency@@3U_GUID@@B ?PPLParallelInvokeEventGuid@Concurrency@@3U_GUID@@B ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ ?ResourceManagerEventGuid@Concurrency@@3U_GUID@@B ?ScheduleGroupEventGuid@Concurrency@@3U_GUID@@B ?ScheduleGroupId@Context@Concurrency@@SAIXZ ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z ?SchedulerEventGuid@Concurrency@@3U_GUID@@B ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z ?VirtualProcessorEventGuid@Concurrency@@3U_GUID@@B ?VirtualProcessorId@Context@Concurrency@@SAIXZ ?Yield@Context@Concurrency@@SAXXZ ?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXXZ ?_Assign@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXABV123@@Z ?_Byte_reverse_table@details@Concurrency@@3QBEB ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ ?_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z ?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ ?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ ?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ ?_Current_node@location@Concurrency@@SA?AV12@XZ ?_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ ?_GetCombinableSize@details@Concurrency@@YAIXZ ?_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ ?_GetConcurrency@details@Concurrency@@YAIXZ ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ ?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ ?_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ ?_Internal_assign@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXI@ZP6AX1PBXI@Z4@Z ?_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IBEIXZ ?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IAEIP6AXPAXI@Z@Z ?_Internal_compact@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIPAXP6AX0I@ZP6AX0PBXI@Z@Z ?_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXPBXI@Z@Z ?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IBE_NXZ ?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IAEXXZ ?_Internal_grow_by@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z ?_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z ?_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPAX@Z ?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IAE_NPAX@Z ?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPBX@Z ?_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIAAI@Z ?_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIII@Z ?_Internal_resize@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIIIP6AXPAXI@ZP6AX0PBXI@Z2@Z ?_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IBEIXZ ?_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IAEXAAV123@@Z ?_Internal_swap@_Concurrent_vector_base_v4@details@Concurrency@@IAEXAAV123@@Z ?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IBEXXZ ?_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IBEXI@Z ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ ?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ ?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_Reference@_Scheduler@details@Concurrency@@QAEIXZ ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_Scheduler@details@Concurrency@@QAEIXZ ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z ?_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KAII@Z ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ ?_SpinYield@Context@Concurrency@@SAXXZ ?_Start@_Timer@details@Concurrency@@IAEXXZ ?_Stop@_Timer@details@Concurrency@@IAEXXZ ?_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ ?_UnderlyingYield@details@Concurrency@@YAXXZ ?_Value@_SpinCount@details@Concurrency@@SAIXZ ?_Yield@_Context@details@Concurrency@@SAXXZ ?cancel@agent@Concurrency@@QAE_NXZ ?current@location@Concurrency@@SA?AV12@XZ ?done@agent@Concurrency@@IAE_NXZ ?from_numa_node@location@Concurrency@@SA?AV12@G@Z ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ ?is_current_task_group_canceling@Concurrency@@YA_NXZ ?lock@critical_section@Concurrency@@QAEXXZ ?lock@reader_writer_lock@Concurrency@@QAEXXZ ?lock_read@reader_writer_lock@Concurrency@@QAEXXZ ?native_handle@critical_section@Concurrency@@QAEAAV12@XZ ?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ ?notify_one@_Condition_variable@details@Concurrency@@QAEXXZ ?reset@event@Concurrency@@QAEXXZ ?set@event@Concurrency@@QAEXXZ ?set_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z ?set_task_execution_resources@Concurrency@@YAXK@Z ?start@agent@Concurrency@@QAE_NXZ ?status@agent@Concurrency@@QAE?AW4agent_status@2@XZ ?status_port@agent@Concurrency@@QAEPAV?$ISource@W4agent_status@Concurrency@@@2@XZ ?try_lock@critical_section@Concurrency@@QAE_NXZ ?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ ?try_lock_for@critical_section@Concurrency@@QAE_NI@Z ?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ ?unlock@critical_section@Concurrency@@QAEXXZ ?unlock@reader_writer_lock@Concurrency@@QAEXXZ ?wait@Concurrency@@YAXI@Z ?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z ?wait@agent@Concurrency@@SA?AW4agent_status@2@PAV12@I@Z ?wait@event@Concurrency@@QAEII@Z ?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z ?wait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z ?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z ?wait_for_one@agent@Concurrency@@SAXIPAPAV12@AAW4agent_status@2@AAII@Z

SAVAPI/elam_ppl/mfc140u.dll

IMPHASH 087250bec47ae040f63b84ccb2ebd086
SHA256 be03d1dabf873ebe9790e955e63229c8d00cf1ffb4f15cf9a114c6951522a7ad
MD5 2b05c61f3c97b3926d871ef073d2b737
SHA1 b45a22ebc5c8ad4bce1b5cc8f2eac62a55852a3c
SHA512 ae07c5bc3f346ccb773eda796583dec3cd2a213fbe2cd31cf8759a12c508ffed595ef8eff79b36241e0784a201989a0ea5f0e8f1c847f9201367d55c44143018
SSDEEP 98304:geAM+5SzS7t2x6aaZlQk3yXujcPLb71vrQ4XOE07MmretFLOAkGkzdnEVomFHKnR:I5SzCtXN871Xn07MmOFLOyomFHKnPws/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

e4:5f:81:3c:0e:e5:df:c3:c3:20:29:c9:e5:35:e1:db:05:f4:80:9c:44:85:d4:c3:c4:bd:e0:54:ce:cf:76:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

549664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin_spectre\i386\mfc140u.i386.spectre.pdb

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumValueW RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegQueryValueW RegSetValueW GetFileSecurityW SetFileSecurityW IsTextUnicode RegOpenKeyExA RegQueryValueExA

kernel32

IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess QueryPerformanceCounter UnhandledExceptionFilter LoadLibraryExA ExpandEnvironmentStringsA GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter LockResource LoadResource FindResourceW GetLastError InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetLastError GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW GetModuleFileNameW OutputDebugStringA MultiByteToWideChar lstrcpyW GlobalAlloc GlobalLock GlobalUnlock GetCurrentThreadId InitializeCriticalSection DeleteFileW MulDiv VerSetConditionMask VerifyVersionInfoW FreeLibrary CloseHandle GetTempPathW CreateFileW SetFilePointer Sleep GetCurrentDirectoryW lstrcmpW GetSystemDirectoryW LoadLibraryExW DecodePointer EncodePointer GlobalFree GetTickCount GetWindowsDirectoryW lstrcmpiW SetThreadPriority LocalAlloc LocalFree TlsAlloc TlsFree GlobalHandle GlobalReAlloc TlsGetValue LocalReAlloc TlsSetValue GetFileSize GetFileAttributesW GlobalSize SearchPathW GetLocaleInfoW GetUserDefaultUILanguage OutputDebugStringW GetSystemInfo VirtualQuery GetSystemDefaultUILanguage FormatMessageA GetEnvironmentVariableA GetEnvironmentVariableW GlobalFlags GlobalFindAtomW GetSystemTime LocalUnlock LocalLock GlobalGetAtomNameW GetAtomNameW SuspendThread ResumeThread SetEvent CopyFileW WaitForMultipleObjects CreateEventW ReleaseMutex CreateMutexW ReleaseSemaphore CreateSemaphoreW WaitForSingleObject FormatMessageW SetFileAttributesW LocalFileTimeToFileTime GetFileAttributesExW GetFileSizeEx FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime FileTimeToSystemTime GetShortPathNameW GetStringTypeExW GetThreadLocale FindClose FindFirstFileW GetVolumeInformationW MoveFileW SetEndOfFile UnlockFile LockFile FlushFileBuffers WriteFile ReadFile GetCurrentProcess DuplicateHandle GetProfileIntW SystemTimeToFileTime ReplaceFileW SetFileTime GetFileTime GetFullPathNameW GetDiskFreeSpaceW GetTempFileNameW VirtualProtect RaiseException lstrcpyA CompareStringW GetCurrentThread GetVersionExW WideCharToMultiByte lstrcmpA CompareStringA GlobalDeleteAtom SetErrorMode GetCurrentProcessId GlobalAddAtomW IsDBCSLeadByte GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW FindResourceExW GetUserDefaultLCID SizeofResource

vcruntime140

_except_handler4_common memcmp wcsrchr wcsstr wcschr _purecall memmove memset memcpy __std_terminate __CxxFrameHandler3 __std_type_info_destroy_list _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _initterm_e _initterm _endthreadex abort _invalid_parameter_noinfo _errno terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll __doserrno _endthread _beginthread _resetstkoflw __p___wargv __p___argc

api-ms-win-crt-string-l1-1-0

iswspace wcscmp wmemcpy_s wcsnlen _wcsicmp wcspbrk wcscspn wcsncpy_s toupper _wcslwr_s wcslen strcpy_s _strnicmp _wcsupr_s _wcsrev wcscoll _wcsicoll wcsncmp wcscpy_s iswdigit iswalpha iswalnum iswprint towupper towlower _wcsnicmp wcsspn wcscat_s strnlen _wcsdup strlen

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle _fileno _open_osfhandle __stdio_common_vsprintf_s clearerr_s fread fclose fflush feof ferror __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vswscanf fwrite __stdio_common_vswprintf_s __stdio_common_vswprintf fputws ftell fseek fgetws

api-ms-win-crt-utility-l1-1-0

labs abs rand_s ldiv

api-ms-win-crt-heap-l1-1-0

_msize malloc _expand realloc _recalloc calloc free

api-ms-win-crt-convert-l1-1-0

_itow_s wcstod wcstoul wcstol _wtol _ltow_s _ultow_s _wtoi

api-ms-win-crt-math-l1-1-0

_fdopen exp ceil sqrt atan2 cos sin floor fabs

api-ms-win-crt-time-l1-1-0

_mktime64 clock _localtime64_s _time64

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _wsplitpath_s _wfullpath

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp _mbsrchr _mbsstr _mbscspn _mbscoll _mbsinc _mbsspn _mbscmp _mbsrev _mbsicoll _mbslwr_s _mbspbrk _mbsupr_s _ismbcspace _mbschr

user32

TranslateAcceleratorW GetSystemMetrics DestroyMenu LoadMenuW GetSubMenu PostThreadMessageW GetClassInfoW DefWindowProcW GetWindow GetMenuItemCount GetMenuItemID IsIconic GetCursorPos DrawIcon GetMonitorInfoW MonitorFromPoint SystemParametersInfoW ValidateRect SetLayeredWindowAttributes CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx GetUpdateRect UnionRect SetWindowPos LockWindowUpdate GetKeyState BeginDeferWindowPos EndDeferWindowPos AppendMenuW CreatePopupMenu IntersectRect SetScrollPos EnableMenuItem GetNextDlgTabItem GetSystemMenu IsMenu IsZoomed ModifyMenuW DeleteMenu SetWindowRgn DestroyAcceleratorTable GetTopWindow DestroyWindow MonitorFromRect EnumDisplayMonitors GetSysColor GetClassLongW IsClipboardFormatAvailable DestroyCursor CreateAcceleratorTableW CopyAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyW CharUpperW SetWindowTextW GetMenuState CheckMenuItem SetFocus GetMenuItemInfoW DrawFrameControl SubtractRect GetLastActivePopup GetMessageW UpdateLayeredWindow EnableScrollBar GetScrollPos GetMenuDefaultItem SetMenuDefaultItem HideCaret InvertRect EnumChildWindows GetWindowTextW GetDoubleClickTime GetDC ReleaseDC GetWindowRgn FrameRect ShowScrollBar IsWindowEnabled InsertMenuW GetActiveWindow RegisterClipboardFormatW GetComboBoxInfo CharUpperBuffW DrawEdge PostQuitMessage UnregisterClassW ShowOwnedPopups LoadAcceleratorsW MessageBoxW SetWindowLongW SetMenuItemBitmaps SetMenuItemInfoW GetMenuCheckMarkDimensions CallWindowProcW SetActiveWindow CreateMenu MoveWindow InvalidateRgn TabbedTextOutW DrawTextW DrawTextExW GrayStringW GetWindowTextLengthW GetTabbedTextExtentW GetDlgItem CreateDialogIndirectParamW EndDialog GetPropW RemovePropW SetPropW MapDialogRect GetMessageTime GetMessagePos GetDialogBaseUnits GetDCEx RemoveMenu MsgWaitForMultipleObjectsEx CharNextW SetWindowContextHelpId IsDialogMessageW ClipCursor SendNotifyMessageW InSendMessage GetMenuStringW WindowFromDC SetScrollRange AdjustWindowRectEx CountClipboardFormats GetMenu SetMenu GetClassInfoExW CreateWindowExW SetWindowPlacement TrackPopupMenuEx RegisterClassW WinHelpW GetScrollRange SetScrollInfo GetScrollInfo ScrollWindow MonitorFromWindow BeginPaint EndPaint SendDlgItemMessageA UnpackDDElParam ReuseDDElParam InsertMenuItemW GetMenuBarInfo GetWindowDC DefFrameProcW TranslateMDISysAccel DrawMenuBar DefMDIChildProcW CheckDlgButton CheckRadioButton GetDlgItemInt GetDlgItemTextW SendDlgItemMessageW SetDlgItemInt SetDlgItemTextW IsDlgButtonChecked ScrollWindowEx RealChildWindowFromPoint CharToOemBuffA OemToCharBuffA IsWindowVisible GetClientRect KillTimer SetRectEmpty GetWindowRect InvalidateRect RedrawWindow IsWindow SetRect EnableWindow IsCharLowerW GetKeyNameTextW GetKeyboardLayout MapVirtualKeyExW GetCapture DrawStateW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetAsyncKeyState GetDesktopWindow WaitMessage DispatchMessageW TranslateMessage PeekMessageW SetForegroundWindow LoadCursorW GetFocus IsChild TrackPopupMenu LoadIconW GetNextDlgGroupItem DrawFocusRect SetCursor GetWindowLongW LoadImageW CopyImage GetIconInfo FillRect NotifyWinEvent CopyRect LoadBitmapW MapWindowPoints MessageBeep SetCursorPos WindowFromPoint ClientToScreen SetCapture ReleaseCapture CopyIcon BringWindowToTop RegisterWindowMessageW DestroyIcon GetClassNameW SetParent ShowWindow GetWindowPlacement IsRectEmpty GetDlgCtrlID PostMessageW DeferWindowPos EqualRect GetSysColorBrush SetClassLongW GetParent DrawIconEx InflateRect OffsetRect PtInRect UpdateWindow SetTimer TrackMouseEvent GetWindowThreadProcessId ScreenToClient GetForegroundWindow SendMessageW

gdi32

PtVisible GetViewportOrgEx DeleteMetaFile CloseMetaFile CreateMetaFileW LPtoDP GetCharWidthW CreateFontW StretchDIBits RoundRect CreateEllipticRgn CreateHatchBrush ExtTextOutW Polyline SetDIBColorTable GetDIBits SelectPalette StretchBlt SetBkColor CreateBitmap EnumFontFamiliesExW CreateRoundRectRgn SetRectRgn FillRgn GetBoundsRect CombineRgn CreateRectRgn PatBlt DeleteDC GetCurrentObject EndDoc EndPage StartPage ExtFloodFill SetPaletteEntries CreateDIBitmap CreatePatternBrush CreatePen EnumFontFamiliesW GetTextCharsetInfo GetDeviceCaps CreateFontIndirectW GetBkColor SetPixel Ellipse CreateDIBSection OffsetRgn CreateRectRgnIndirect GetRgnBox BitBlt SetPixelV CreateCompatibleBitmap FrameRgn PtInRegion CreatePolygonRgn GetPixel GetSystemPaletteEntries GetNearestPaletteIndex RealizePalette CreatePalette GetPaletteEntries GetStockObject TextOutW Polygon GetTextColor GetObjectType DeleteObject SelectObject CreateCompatibleDC GetObjectW CreateSolidBrush GetTextExtentPoint32W GetTextMetricsW GetClipBox Escape GetTextAlign GetCurrentPositionEx MoveToEx SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SaveDC RestoreDC GetROP2 GetBkMode GetPolyFillMode GetStretchBltMode GetNearestColor GetTextFaceW GetWindowExtEx GetViewportExtEx SetTextColor SetMapMode SetWindowExtEx ScaleWindowExtEx GetWindowOrgEx SetWindowOrgEx IntersectClipRect CreateDCW SetBrushOrgEx SetAbortProc StartDocW DPtoLP AbortDoc CopyMetaFileW UnrealizeObject SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetGraphicsMode SetWorldTransform ModifyWorldTransform OffsetWindowOrgEx SelectClipRgn ExcludeClipRect OffsetClipRgn LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetLayout SetLayout ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo SelectClipPath GetClipRgn ExtSelectClipRgn PlayMetaFileRecord PlayMetaFile EnumMetaFile ExtCreatePen CreateDIBPatternBrushPt GetMapMode RectVisible Rectangle

ole32

OleLockRunning CoTaskMemFree OleSetContainedObject CoCreateInstance OleDraw OleRegGetMiscStatus StgOpenStorageOnILockBytes CLSIDFromString OleRegEnumVerbs CoDisconnectObject CoRegisterMessageFilter CoTreatAsClass CoCreateGuid SetConvertStg WriteFmtUserTypeStg OleDuplicateData WriteClassStg GetRunningObjectTable OleTranslateAccelerator IsAccelerator PropVariantClear CoFreeUnusedLibraries CoInitialize CoRevokeClassObject CoRegisterClassObject RevokeDragDrop CLSIDFromProgID RegisterDragDrop CoLockObjectExternal DoDragDrop CoUninitialize CoGetMalloc StgOpenStorage StgIsStorageFile StgCreateDocfile OleIsCurrentClipboard OleSetClipboard OleGetClipboard OleRegGetUserType GetClassFile CreateBindCtx CreateFileMoniker OleRun StringFromCLSID OleUninitialize OleIsRunning OleQueryLinkFromData OleQueryCreateFromData OleSetMenuDescriptor CreateGenericComposite CreateItemMoniker WriteClassStm OleGetIconOfClass GetHGlobalFromILockBytes ReadClassStg OleLoad OleSave PropVariantCopy CoInitializeEx CoGetClassObject StringFromGUID2 ReadFmtUserTypeStg OleLoadFromStream StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal ReadClassStm OleSaveToStream CreateOleAdviseHolder OleDestroyMenuDescriptor OleCreateMenuDescriptor ReleaseStgMedium CreateDataAdviseHolder CreateDataCache OleCreate OleCreateLinkToFile OleCreateFromFile CoTaskMemAlloc CreateStreamOnHGlobal OleCreateStaticFromData OleCreateLinkFromData OleCreateFromData OleInitialize OleFlushClipboard

oleaut32

SysAllocStringLen SysAllocString SysStringLen SysFreeString VariantChangeType VariantClear VariantTimeToSystemTime SystemTimeToVariantTime VarParseNumFromStr SafeArrayCreateVector VarBstrFromDec VarDecFromStr VarDateFromStr SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SafeArrayAllocData SafeArrayCopy VarBstrFromCy VarCyFromStr SysReAllocStringLen SysAllocStringByteLen SafeArrayRedim SafeArrayCreate SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayGetDim SysStringByteLen SafeArrayDestroy VariantCopy VarBstrCmp DispCallFunc VariantInit LoadRegTypeLi RegisterTypeLi LoadTypeLi OleLoadPicture OleCreatePictureIndirect OleCreateFontIndirect OleTranslateColor OleCreatePropertyFrame VarBstrFromDate

shlwapi

StrFormatKBSizeW PathFindExtensionW PathFindFileNameW PathRemoveExtensionW PathRemoveFileSpecW PathIsUNCW PathStripToRootW UrlUnescapeW

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

uxtheme

DrawThemeParentBackground GetWindowTheme DrawThemeBackground GetThemeColor OpenThemeData CloseThemeData GetCurrentThemeName GetThemeSysColor DrawThemeText IsThemeBackgroundPartiallyTransparent GetThemePartSize IsAppThemed

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/elam_ppl/msvcp140.dll

IMPHASH b762273fad87a3ab566b1559c5b77d45
SHA256 038a419c6225eda86802dd2bfbc636cc4f7d175c64937f51acded8f1785e8a12
MD5 fcdc4950a9f9bc8da12eae2b1cfd582a
SHA1 ab4fc2d8154b8b141f61711e3be1fbab379e13f3
SHA512 8949df41cd37ae67e421375fa8c74c0fcf92da39d1a5f8ee52de55e0b05982afd4a73d8e9ac6d2b5f06245fb3ded985a41fc7a7406cff147ad4575753cf357d9
SSDEEP 12288:CnIPHMVwD9dq5/iNJ6PJ0F5HCrdhUgiW6QR7t5s03Ooc8dHkC2eseG1:CnIPHMVwD0iNJy0FdN03Ooc8dHkC2e/K
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

5a:b7:57:be:7e:c9:ee:0b:d5:f5:60:22:08:b1:18:8c:c9:ad:4c:36:04:3e:34:aa:1e:ec:53:36:91:06:e9:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

250640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb

vcruntime140

_except_handler4_common __uncaught_exceptions __uncaught_exception memmove __std_terminate _purecall __CxxFrameHandler3 _CxxThrowException __AdjustPointer __processing_throw __current_exception __std_exception_destroy __std_exception_copy memset memcmp memchr __std_type_info_destroy_list memcpy

api-ms-win-crt-locale-l1-1-0

__pctype_func ___lc_locale_name_func localeconv setlocale _unlock_locales ___lc_collate_cp_func ___mb_cur_max_func ___lc_codepage_func _lock_locales

api-ms-win-crt-string-l1-1-0

wcsnlen wcscpy_s isupper iswctype __strncnt tolower isalnum isxdigit isspace islower isdigit strcspn _wcsdup

api-ms-win-crt-heap-l1-1-0

malloc calloc realloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_endthreadex _initterm_e _initterm _errno _invalid_parameter_noinfo_noreturn abort _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _cexit _crt_atexit _execute_onexit_table _register_onexit_function _set_new_handler _initialize_onexit_table _beginthreadex terminate

api-ms-win-crt-math-l1-1-0

frexp _CIlog _CIpow ldexp

api-ms-win-crt-convert-l1-1-0

strtod btowc strtof

api-ms-win-crt-stdio-l1-1-0

_fsopen fseek fputs ungetc setvbuf fwrite _fseeki64 fsetpos _wfsopen fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vsprintf_s fread ungetwc fputwc fgetwc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wrename _unlock_file _wchdir _wrmdir _wremove

api-ms-win-crt-time-l1-1-0

_Strftime _Gettnames _Getmonths _Wcsftime _W_Getdays _Getdays _W_Gettnames _W_Getmonths

api-ms-win-crt-environment-l1-1-0

_wgetcwd

api-ms-win-crt-utility-l1-1-0

rand_s

kernel32

QueueUserWorkItem WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW MultiByteToWideChar EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WideCharToMultiByte EncodePointer DecodePointer RaiseException LoadLibraryExA FreeLibrary VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead GetCurrentProcessId IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetProcAddress GetModuleHandleW GetTickCount GetSystemTimeAsFileTime CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetModuleHandleExW CloseHandle IsProcessorFeaturePresent RtlCaptureStackBackTrace TryEnterCriticalSection FormatMessageW CreateHardLinkW CopyFileW GetLastError AreFileApisANSI GetTempPathW SetFileTime SetFilePointerEx SetFileAttributesW SetEndOfFile GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindClose CreateFileW CreateDirectoryW GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo

??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z ??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z ??0?$_Yarn@D@std@@QAE@ABV01@@Z ??0?$_Yarn@D@std@@QAE@PBD@Z ??0?$_Yarn@D@std@@QAE@XZ ??0?$_Yarn@G@std@@QAE@ABV01@@Z ??0?$_Yarn@G@std@@QAE@PBG@Z ??0?$_Yarn@G@std@@QAE@XZ ??0?$_Yarn@_W@std@@QAE@ABV01@@Z ??0?$_Yarn@_W@std@@QAE@PB_W@Z ??0?$_Yarn@_W@std@@QAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ ??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@ABV01@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@ABV01@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@ABV01@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@W4_Uninitialized@1@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$codecvt@DDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@DDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@I@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z ??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z ??0?$ctype@D@std@@QAE@PBF_NI@Z ??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z ??0?$ctype@G@std@@QAE@I@Z ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z ??0?$ctype@_W@std@@QAE@I@Z ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z ??0Init@ios_base@std@@QAE@XZ ??0_Facet_base@std@@QAE@ABV01@@Z ??0_Facet_base@std@@QAE@XZ ??0_Init_locks@std@@QAE@XZ ??0_Locimp@locale@std@@AAE@ABV012@@Z ??0_Locimp@locale@std@@AAE@_N@Z ??0_Locinfo@std@@QAE@HPBD@Z ??0_Locinfo@std@@QAE@PBD@Z ??0_Lockit@std@@QAE@H@Z ??0_Lockit@std@@QAE@XZ ??0_Timevec@std@@QAE@ABV01@@Z ??0_Timevec@std@@QAE@PAX@Z ??0_UShinit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??0codecvt_base@std@@QAE@I@Z ??0ctype_base@std@@QAE@I@Z ??0facet@locale@std@@IAE@I@Z ??0id@locale@std@@QAE@I@Z ??0ios_base@std@@IAE@XZ ??0task_continuation_context@Concurrency@@AAE@XZ ??0time_base@std@@QAE@I@Z ??1?$_Yarn@D@std@@QAE@XZ ??1?$_Yarn@G@std@@QAE@XZ ??1?$_Yarn@_W@std@@QAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$codecvt@DDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@_SDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@_UDU_Mbstatet@@@std@@MAE@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ ??1?$ctype@D@std@@MAE@XZ ??1?$ctype@G@std@@MAE@XZ ??1?$ctype@_W@std@@MAE@XZ ??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ ??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ ??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ ??1Init@ios_base@std@@QAE@XZ ??1_Facet_base@std@@UAE@XZ ??1_Init_locks@std@@QAE@XZ ??1_Locimp@locale@std@@MAE@XZ ??1_Locinfo@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??1_Timevec@std@@QAE@XZ ??1_UShinit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1codecvt_base@std@@UAE@XZ ??1ctype_base@std@@UAE@XZ ??1facet@locale@std@@MAE@XZ ??1ios_base@std@@UAE@XZ ??1time_base@std@@UAE@XZ ??4?$_Iosb@H@std@@QAEAAV01@$$QAV01@@Z ??4?$_Iosb@H@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@D@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ??4?$_Yarn@G@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@G@std@@QAEAAV01@PBG@Z ??4?$_Yarn@_W@std@@QAEAAV01@ABV01@@Z ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z ??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_istream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_istream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z ??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEAAV01@ABV01@@Z ??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEAAV01@ABV01@@Z ??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEAAV01@ABV01@@Z ??4Init@ios_base@std@@QAEAAV012@ABV012@@Z ??4_Crt_new_delete@std@@QAEAAU01@$$QAU01@@Z ??4_Crt_new_delete@std@@QAEAAU01@ABU01@@Z ??4_Facet_base@std@@QAEAAV01@ABV01@@Z ??4_Init_locks@std@@QAEAAV01@ABV01@@Z ??4_Timevec@std@@QAEAAV01@ABV01@@Z ??4_UShinit@std@@QAEAAV01@ABV01@@Z ??4_Winit@std@@QAEAAV01@ABV01@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAJ@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAO@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAJ@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAN@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAO@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAPAX@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z ??7ios_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ??Bios_base@std@@QBE_NXZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$codecvt@DDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@GDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_SDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_UDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ ??_7?$ctype@D@std@@6B@ ??_7?$ctype@G@std@@6B@ ??_7?$ctype@_W@std@@6B@ ??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ ??_7_Locimp@locale@std@@6B@ ??_7codecvt_base@std@@6B@ ??_7ctype_base@std@@6B@ ??_7facet@locale@std@@6B@ ??_7ios_base@std@@6B@ ??_7time_base@std@@6B@ ??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@ ??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@ ??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@ ??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@ ??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@ ??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@ ??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@ ??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@ ??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@ ??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@ ??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEXXZ ??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ ??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_F?$codecvt@DDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@GDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@_SDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@_UDU_Mbstatet@@@std@@QAEXXZ ??_F?$codecvt@_WDU_Mbstatet@@@std@@QAEXXZ ??_F?$ctype@D@std@@QAEXXZ ??_F?$ctype@G@std@@QAEXXZ ??_F?$ctype@_W@std@@QAEXXZ ??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ ??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ ??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ ??_F_Locinfo@std@@QAEXXZ ??_F_Timevec@std@@QAEXXZ ??_Fcodecvt_base@std@@QAEXXZ ??_Fctype_base@std@@QAEXXZ ??_Ffacet@locale@std@@QAEXXZ ??_Fid@locale@std@@QAEXXZ ??_Ftime_base@std@@QAEXXZ ?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?GetNextAsyncId@platform@details@Concurrency@@YAIXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ ?_Addcats@_Locinfo@std@@QAEAAV12@HPBD@Z ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z ?_Addstd@ios_base@std@@SAXPAV12@@Z ?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z ?_Atexit@@YAXP6AXXZ@Z ?_BADOFF@std@@3_JB ?_C_str@?$_Yarn@D@std@@QBEPBDXZ ?_C_str@?$_Yarn@G@std@@QBEPBGXZ ?_C_str@?$_Yarn@_W@std@@QBEPB_WXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z ?_Callfns@ios_base@std@@AAEXW4event@12@@Z ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ ?_Clocptr@_Locimp@locale@std@@0PAV123@A ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Donarrow@?$ctype@G@std@@IBEDGD@Z ?_Donarrow@?$ctype@_W@std@@IBED_WD@Z ?_Dowiden@?$ctype@G@std@@IBEGD@Z ?_Dowiden@?$ctype@_W@std@@IBE_WD@Z ?_Empty@?$_Yarn@D@std@@QBE_NXZ ?_Empty@?$_Yarn@G@std@@QBE_NXZ ?_Empty@?$_Yarn@_W@std@@QBE_NXZ ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADDH@Z ?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADDH@Z ?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z ?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z ?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z ?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@_SDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@_UDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getdateorder@_Locinfo@std@@QBEHXZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getfalse@_Locinfo@std@@QBEPBDXZ ?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z ?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z ?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z ?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z ?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z ?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z ?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z ?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z ?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z ?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z ?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z ?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAAHABV?$ctype@G@2@@Z ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z ?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_Getname@_Locinfo@std@@QBEPBDXZ ?_Getptr@_Timevec@std@@QBEPAXXZ ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ ?_Gettrue@_Locinfo@std@@QBEPBDXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ ?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Id_cnt@id@locale@std@@0HA ?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADPBDH@Z ?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADPBDH@Z ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z ?_Incref@facet@locale@std@@UAEXXZ ?_Index@ios_base@std@@0HA ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAPAG0PAH001@Z ?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPAPA_W0PAH001@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?_Init@?$codecvt@DDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@GDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@_SDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@_UDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$codecvt@_WDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$ctype@G@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$ctype@_W@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z ?_Init@ios_base@std@@IAEXXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Init_cnt@Init@ios_base@std@@0HA ?_Init_cnt@_UShinit@std@@0HA ?_Init_cnt@_Winit@std@@0HA ?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ ?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z ?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z ?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z ?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z ?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z ?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ ?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z ?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z ?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z ?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z ?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z ?_Lockit_ctor@_Lockit@std@@SAXH@Z ?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z ?_Lockit_dtor@_Lockit@std@@SAXH@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_MP_Add@std@@YAXQA_K_K@Z ?_MP_Get@std@@YA_KQA_K@Z ?_MP_Mul@std@@YAXQA_K_K1@Z ?_MP_Rem@std@@YAXQA_K_K@Z ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z ?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z ?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z ?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z ?_Mtx_delete@threads@stdext@@YAXPAX@Z ?_Mtx_lock@threads@stdext@@YAXPAX@Z ?_Mtx_new@threads@stdext@@YAXAAPAX@Z ?_Mtx_unlock@threads@stdext@@YAXPAX@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ ?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Ptr_cerr@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ptr_cin@std@@3PAV?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Ptr_clog@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ptr_cout@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ptr_wcerr@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A ?_Ptr_wcerr@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Ptr_wcin@std@@3PAV?$basic_istream@GU?$char_traits@G@std@@@1@A ?_Ptr_wcin@std@@3PAV?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?_Ptr_wclog@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A ?_Ptr_wclog@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A ?_Ptr_wcout@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z ?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBGI@Z ?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA ?_Random_device@std@@YAIXZ ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z ?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@GI@Z ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reschedule_chore@details@Concurrency@@YAHPBU_Threadpool_chore@12@@Z ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Rng_abort@std@@YAXPBD@Z ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z ?_Setgloballocale@locale@std@@CAXPAX@Z ?_Src@?1??_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1HABVlocale@3@@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1HABVlocale@3@@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1HABVlocale@3@@Z@4QBDB ?_Sync@ios_base@std@@0_NA ?_Syserror_map@std@@YAPBDH@Z ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?_Tidy@?$_Yarn@D@std@@AAEXXZ ?_Tidy@?$_Yarn@G@std@@AAEXXZ ?_Tidy@?$_Yarn@_W@std@@AAEXXZ ?_Tidy@?$ctype@D@std@@IAEXXZ ?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AAEXXZ ?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AAEXXZ ?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AAEXXZ ?_Tidy@ios_base@std@@AAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ ?_Winerror_map@std@@YAHH@Z ?_Winerror_message@std@@YAKKPADK@Z ?_XGetLastError@std@@YAXXZ ?_XLgamma@std@@YAMM@Z ?_XLgamma@std@@YANN@Z ?_XLgamma@std@@YAOO@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xoverflow_error@std@@YAXPBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xruntime_error@std@@YAXPBD@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrCompare@@YA_NPBX0@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrSwap@@YAXPAX0@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?bad@ios_base@std@@QBE_NXZ ?c_str@?$_Yarn@D@std@@QBEPBDXZ ?c_str@?$_Yarn@G@std@@QBEPBGXZ ?c_str@?$_Yarn@_W@std@@QBEPB_WXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?classic@locale@std@@SAABV12@XZ ?classic_table@?$ctype@D@std@@SAPBFXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z ?clear@ios_base@std@@QAEXH@Z ?clear@ios_base@std@@QAEXH_N@Z ?clear@ios_base@std@@QAEXI@Z ?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z ?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEAAV12@ABV12@@Z ?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEAAV12@ABV12@@Z ?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ ?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ ?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ ?do_always_noconv@?$codecvt@DDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@_SDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@_UDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ ?do_always_noconv@codecvt_base@std@@MBE_NXZ ?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ ?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ ?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ ?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ ?do_encoding@codecvt_base@std@@MBEHXZ ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?do_get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?do_get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?do_get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?do_in@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z ?do_in@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z ?do_in@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z ?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z ?do_is@?$ctype@G@std@@MBE_NFG@Z ?do_is@?$ctype@_W@std@@MBEPB_WPB_W0PAF@Z ?do_is@?$ctype@_W@std@@MBE_NF_W@Z ?do_length@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z ?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ ?do_max_length@codecvt_base@std@@MBEHXZ ?do_narrow@?$ctype@D@std@@MBEDDD@Z ?do_narrow@?$ctype@D@std@@MBEPBDPBD0DPAD@Z ?do_narrow@?$ctype@G@std@@MBEDGD@Z ?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z ?do_narrow@?$ctype@_W@std@@MBED_WD@Z ?do_narrow@?$ctype@_W@std@@MBEPB_WPB_W0DPAD@Z ?do_out@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z ?do_out@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z ?do_out@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z ?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z ?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z ?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z ?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z ?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z ?do_scan_is@?$ctype@_W@std@@MBEPB_WFPB_W0@Z ?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z ?do_scan_not@?$ctype@_W@std@@MBEPB_WFPB_W0@Z ?do_tolower@?$ctype@D@std@@MBEDD@Z ?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z ?do_tolower@?$ctype@G@std@@MBEGG@Z ?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z ?do_tolower@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z ?do_tolower@?$ctype@_W@std@@MBE_W_W@Z ?do_toupper@?$ctype@D@std@@MBEDD@Z ?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z ?do_toupper@?$ctype@G@std@@MBEGG@Z ?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z ?do_toupper@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z ?do_toupper@?$ctype@_W@std@@MBE_W_W@Z ?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z ?do_widen@?$ctype@D@std@@MBEDD@Z ?do_widen@?$ctype@D@std@@MBEPBDPBD0PAD@Z ?do_widen@?$ctype@G@std@@MBEGD@Z ?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z ?do_widen@?$ctype@_W@std@@MBEPBDPBD0PA_W@Z ?do_widen@?$ctype@_W@std@@MBE_WD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?empty@?$_Yarn@D@std@@QBE_NXZ ?empty@?$_Yarn@G@std@@QBE_NXZ ?empty@?$_Yarn@_W@std@@QBE_NXZ ?empty@locale@std@@SA?AV12@XZ ?encoding@codecvt_base@std@@QBEHXZ ?eof@ios_base@std@@QBE_NXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?exceptions@ios_base@std@@QAEXH@Z ?exceptions@ios_base@std@@QAEXI@Z ?exceptions@ios_base@std@@QBEHXZ ?fail@ios_base@std@@QBE_NXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEGG@Z ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ?flags@ios_base@std@@QAEHH@Z ?flags@ios_base@std@@QBEHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ ?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QBE_JXZ ?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QBE_JXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAG@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AA_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z ?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBG4@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PB_W4@Z ?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_new_handler@std@@YAP6AXXZXZ ?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?global@locale@std@@SA?AV12@ABV12@@Z ?good@ios_base@std@@QBE_NXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$collate@G@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$ctype@G@std@@2V0locale@2@A ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$messages@D@std@@2V0locale@2@A ?id@?$messages@G@std@@2V0locale@2@A ?id@?$messages@_W@std@@2V0locale@2@A ?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$moneypunct@D$00@std@@2V0locale@2@A ?id@?$moneypunct@D$0A@@std@@2V0locale@2@A ?id@?$moneypunct@G$00@std@@2V0locale@2@A ?id@?$moneypunct@G$0A@@std@@2V0locale@2@A ?id@?$moneypunct@_W$00@std@@2V0locale@2@A ?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A ?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$numpunct@G@std@@2V0locale@2@A ?id@?$numpunct@_W@std@@2V0locale@2@A ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JG@Z ?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JG@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z ?in@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z ?in@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ ?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JXZ ?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z ?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z ?intl@?$moneypunct@D$00@std@@2_NB ?intl@?$moneypunct@D$0A@@std@@2_NB ?intl@?$moneypunct@G$00@std@@2_NB ?intl@?$moneypunct@G$0A@@std@@2_NB ?intl@?$moneypunct@_W$00@std@@2_NB ?intl@?$moneypunct@_W$0A@@std@@2_NB ?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z ?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z ?is@?$ctype@D@std@@QBEPBDPBD0PAF@Z ?is@?$ctype@D@std@@QBE_NFD@Z ?is@?$ctype@G@std@@QBEPBGPBG0PAF@Z ?is@?$ctype@G@std@@QBE_NFG@Z ?is@?$ctype@_W@std@@QBEPB_WPB_W0PAF@Z ?is@?$ctype@_W@std@@QBE_NF_W@Z ?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ ?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?iword@ios_base@std@@QAEAAJH@Z ?length@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?length@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z ?max_length@codecvt_base@std@@QBEHXZ ?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEX$$QAV12@@Z ?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z ?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEX$$QAV12@@Z ?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z ?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEX$$QAV12@@Z ?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z ?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z ?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEDGD@Z ?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBED_WD@Z ?narrow@?$ctype@D@std@@QBEDDD@Z ?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z ?narrow@?$ctype@G@std@@QBEDGD@Z ?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z ?narrow@?$ctype@_W@std@@QBED_WD@Z ?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z ?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ ?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ ?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE_NXZ ?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z ?out@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z ?out@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z ?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z ?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ ?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?precision@ios_base@std@@QAE_J_J@Z ?precision@ios_base@std@@QBE_JXZ ?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PAD_J@Z ?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAG_J@Z ?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PA_W_J@Z ?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ ?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z ?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z ?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@PBG3@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z ?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?pword@ios_base@std@@QAEAAPAXH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAV32@@Z ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PAV32@@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?rdstate@ios_base@std@@QBEHXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z ?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z ?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z ?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z ?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z ?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z ?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?scan_is@?$ctype@D@std@@QBEPBDFPBD0@Z ?scan_is@?$ctype@G@std@@QBEPBGFPBG0@Z ?scan_is@?$ctype@_W@std@@QBEPB_WFPB_W0@Z ?scan_not@?$ctype@D@std@@QBEPBDFPBD0@Z ?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z ?scan_not@?$ctype@_W@std@@QBEPB_WFPB_W0@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z ?set_rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z ?set_rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z ?setbase@std@@YA?AU?$_Smanip@H@1@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?setf@ios_base@std@@QAEHH@Z ?setf@ios_base@std@@QAEHHH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z ?setstate@ios_base@std@@QAEXH@Z ?setstate@ios_base@std@@QAEXH_N@Z ?setstate@ios_base@std@@QAEXI@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z ?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z ?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z ?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ ?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ ?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z ?swap@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z ?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z ?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_istream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z ?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z ?swap@ios_base@std@@QAEXAAV12@@Z ?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ ?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?table@?$ctype@D@std@@QBEPBFXZ ?table_size@?$ctype@D@std@@2IB ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@PAV32@@Z ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PAV32@@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?tolower@?$ctype@D@std@@QBEDD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?tolower@?$ctype@G@std@@QBEGG@Z ?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ?toupper@?$ctype@D@std@@QBEDD@Z ?toupper@?$ctype@D@std@@QBEPBDPADPBD@Z ?toupper@?$ctype@G@std@@QBEGG@Z ?toupper@?$ctype@G@std@@QBEPBGPAGPBG@Z ?toupper@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?toupper@?$ctype@_W@std@@QBE_W_W@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?uncaught_exception@std@@YA_NXZ ?uncaught_exceptions@std@@YAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ ?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?unsetf@ios_base@std@@QAEXH@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ?widen@?$ctype@D@std@@QBEDD@Z ?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z ?widen@?$ctype@G@std@@QBEGD@Z ?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z ?widen@?$ctype@_W@std@@QBEPBDPBD0PA_W@Z ?widen@?$ctype@_W@std@@QBE_WD@Z ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBG_J@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z ?xalloc@ios_base@std@@SAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z _Chmod _Close_dir _Cnd_broadcast _Cnd_destroy _Cnd_destroy_in_situ _Cnd_do_broadcast_at_thread_exit _Cnd_init _Cnd_init_in_situ _Cnd_register_at_thread_exit _Cnd_signal _Cnd_timedwait _Cnd_unregister_at_thread_exit _Cnd_wait _Copy_file _Cosh _Current_get _Current_set _Denorm _Dtest _Equivalent _Exp _FCosh _FDenorm _FDtest _FExp _FInf _FNan _FSinh _FSnan _File_size _Getcoll _Getctype _Getcvt _Getdateorder _Getwctype _Getwctypes _Hard_links _Hugeval _Inf _LCosh _LDenorm _LDtest _LExp _LInf _LNan _LSinh _LSnan _Last_write_time _Link _Lock_shared_ptr_spin_lock _Lstat _Make_dir _Mbrtowc _Mtx_clear_owner _Mtx_current_owns _Mtx_destroy _Mtx_destroy_in_situ _Mtx_getconcrtcs _Mtx_init _Mtx_init_in_situ _Mtx_lock _Mtx_reset_owner _Mtx_timedlock _Mtx_trylock _Mtx_unlock _Mtxdst _Mtxinit _Mtxlock _Mtxunlock _Nan _Open_dir _Query_perf_counter _Query_perf_frequency _Read_dir _Remove_dir _Rename _Resize _Set_last_write_time _Sinh _Snan _Stat _Statvfs _Stod _Stodx _Stof _Stofx _Stold _Stoldx _Stoll _Stollx _Stolx _Stoul _Stoull _Stoullx _Stoulx _Strcoll _Strxfrm _Symlink _Symlink_get _Temp_get _Thrd_abort _Thrd_create _Thrd_current _Thrd_detach _Thrd_equal _Thrd_exit _Thrd_hardware_concurrency _Thrd_id _Thrd_join _Thrd_sleep _Thrd_start _Thrd_yield _To_byte _To_wide _Tolower _Toupper _Towlower _Towupper _Unlink _Unlock_shared_ptr_spin_lock _WStod _WStodx _WStof _WStofx _WStold _WStoldx _Wcrtomb _Wcscoll _Wcsxfrm _Xtime_diff_to_millis _Xtime_diff_to_millis2 _Xtime_get_ticks __Wcrtomb_lk __crtCloseThreadpoolTimer __crtCloseThreadpoolWait __crtCompareStringA __crtCompareStringEx __crtCompareStringW __crtCreateEventExW __crtCreateSemaphoreExW __crtCreateSymbolicLinkW __crtCreateThreadpoolTimer __crtCreateThreadpoolWait __crtFlushProcessWriteBuffers __crtFreeLibraryWhenCallbackReturns __crtGetCurrentProcessorNumber __crtGetFileInformationByHandleEx __crtGetLocaleInfoEx __crtGetSystemTimePreciseAsFileTime __crtGetTickCount64 __crtInitOnceExecuteOnce __crtInitializeCriticalSectionEx __crtIsPackagedApp __crtLCMapStringA __crtLCMapStringEx __crtLCMapStringW __crtSetFileInformationByHandle __crtSetThreadpoolTimer __crtSetThreadpoolWait __crtWaitForThreadpoolTimerCallbacks __set_stl_sync_api_mode xtime_get

Name

.text

Size

391KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/elam_ppl/vcruntime140.dll

IMPHASH 6a84b7445ccacd5d29ac27de2745f356
SHA256 ee2d1077b36102794673334095fc60262cb03d7f66a42a3e9c93804338276987
MD5 711b62e03fa4749550f538a5c6ff97d7
SHA1 e67833c3642e41acd6aae9890444b5a0ad9688f9
SHA512 2ae853dc5cd708281a732610789d63d3c324a028b9ab57089ff2216692b7c69caa1068daf660bcec30f1feae394fae814619948954baf8d5c8692e5788cbe622
SSDEEP 1536:usK8Oxv5v9RslezBDbbqVoZ9Sh1gfobWBecbYbU00:usK5v9Gl6tbb6oKhCtecbYbP0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

55:18:05:a3:44:33:57:19:8a:03:89:ab:85:27:85:a0:3e:58:1e:9a:eb:61:89:65:d8:85:44:a1:c7:1e:9f:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 8, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0d:ab:d0:4a:0d:d4:4c:25:d9:2d:a2:7b:1d:e1:3c:58

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 9, 2018 - Jul 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

6

Entry point

55488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\4\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

SAVAPI/elam_ppl/win32/win10RS6/amselam.sys

IMPHASH 4a4c289374fe02e199c10129642c2c9e
SHA256 9d2479cfe101d6734b01f053398e3ba17154d456c774d8bc619c544831895052
MD5 b3844014d965c15f8b6b8c3a8cf1e7ec
SHA1 c1a7f8f550c2365f57e6f80b01d91b201fdef30d
SHA512 8e7262bff3cde9fa8632efef4bee3534c8965d71be58747ddda7e4b7607b4d5a329db9c3c8bfb25764f028462dc16314aad5804c4923e27df0c7e5286aa2bac0
SSDEEP 192:xjM9t+HnCCUHFrw4372weX5wwyMAx6um6JonC7fo8k9CUqoOWiVdDIVWQ4PGWIQ3:2SHdUHNsXb6Joo+9Fq0/oK6ldCE
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e3:00:ef:2c:a1:d3:0d:fa:b1:ee:db:f5:65:99:d3:02:7b:80:5a:90:8a:78:d3:9e:7b:d4:54:43:3a:23:60:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

6788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Bld\125\822\bin\Win32\Release8\amselam.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

848B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/elam_ppl/win64/win10RS6/amselam.sys

IMPHASH 19914a0a128c4dadb1ba4e77a20e1f38
SHA256 927fa480ef9d4ffa528e3813604e1373983d3c1bdfd25808d0d886392d43958e
MD5 2c89a100c30bcff13fe0e6aab0e77f44
SHA1 d2508a3ec992926ded7be789de611a2645b3f454
SHA512 bdab44365c26b65eeefd7caa70ecfdaba1ac04c93559a938a665adf45da0b0c8fc0efa3b9486a7a6b893e7de0799f79a0da330a40adca3a9ebe3c03de2328975
SSDEEP 384:pRd4e6GW43CbZPYPufVUIFfoxOp1x09lEmEAO:p8e6GWjNQ21FwxOpwjO
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

e9:02:2b:1a:7a:63:56:a6:6b:0a:85:60:44:b2:06:e9:72:b6:a9:68:a3:35:84:ff:b5:50:5d:76:06:65:db:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

6192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\Bld\125\822\bin\x64\Release8\amselam.pdb

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

860B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/README

SHA256 006380095181e4291a88e1edd5c00258cdecd1c34e9d07a54ebca0a67b621578
MD5 8c4504c84273e7ec7be437cbd723cabd
SHA1 a10fb9ed6dbaaae70116726f5c002df7ab94542d
SHA512 5864d1a7140369857af54aa5db1437e1bcf2df127bb46f483a455f31a6950707b2a263e2911ae905cb659d4a47da4bb8f211c4df1a853525fa32d63385fa48c6
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win32/win7/avgntflt.cat

SHA256 7ee5e19106b3ef2df2a2026f7bbde9743faa0cc6cffe72b50cac858154c24a30
MD5 388bfd259a5523dc0eef0d7220ef7df0
SHA1 c086834640d289f5d6cdd5a8a0ad73b644608189
SHA512 485b9897f212ca92a00c512ade5ecaf129a7875ce6c86cf799fa8cc63fe1bee16f93d84dbbcce24be9d85c502fa9628cea1d8fb4650525e5c6f31d31ccefa528
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avgntflt.inf

SHA256 455ddf332e67840e44c59465cf96fb983d1641eec5e1db3f5c9c20bd5ec148a9
MD5 90786be47f7a15a7788db19168d85deb
SHA1 01dc85a5dff0ced5ef7bf090bab6a6424c477225
SHA512 131f35077eff86895a2d799f29a2b871edac8f36902e018a9f3af34906f4ad6a824bfdcbe4ea378555b42b59ffff5f8bc9f2b5c1ee61bbeb250c4162ad9d5d5b
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avgntflt.sys

IMPHASH 7e0b7a6b8c4a6a97b946117c9010b507
SHA256 d4f1608c1358e9096ecd5b26e1ff67ffaae061097050d0cd2fee2a03ad1c1864
MD5 6a8a0d1da0f9c43cae63052994a679e7
SHA1 52200af95d3d2136863d4d70646a8745b8116627
SHA512 02605e53d035277434124f8d0e90019a5945ead5f4f10a62df609fd300b5dbac000fb4059289b15ceb10ee5a4589dc981e46bfd57a0d657271a020f5e507afcc
SSDEEP 3072:BG0/ewd/JurIulKjCEe6Rar87j/s+L2LVBYE7i08xCvbx:BG0/ewd/JoIFv7jUmoYeOWbx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

ec:48:29:9e:2b:fa:44:7b:da:91:a0:5a:e9:18:2a:c8:10:8c:74:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 7, 2019

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

1

Major OS version

6

Entry point

156286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_x86\i386\avgntflt.pdb

ntoskrnl.exe

KeQueryPriorityThread SeQueryInformationToken KeLeaveCriticalRegion ExReleaseResourceLite ExAcquireResourceExclusiveLite KeEnterCriticalRegion SeCreateClientSecurity IoGetStackLimits ExAcquireResourceSharedLite RtlFreeUnicodeString RtlUpcaseUnicodeString ZwQueryValueKey ZwOpenKey toupper ZwReadFile ZwQueryInformationToken ZwOpenProcessTokenEx ZwOpenProcess _alldiv IoCreateSynchronizationEvent KeInsertQueueApc KeInitializeApc InterlockedPopEntrySList ZwDeleteValueKey ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject PsGetCurrentThreadId RtlUpcaseUnicodeChar ZwQueryDirectoryFile RtlAppendUnicodeToString ZwOpenFile wcsncat RtlAnsiStringToUnicodeString RtlInitAnsiString ZwSetInformationFile ZwQueryInformationFile InterlockedPushEntrySList IoGetTopLevelIrp NtClose ObReferenceObjectByHandle IoFileObjectType RtlEqualSid RtlGetOwnerSecurityDescriptor ZwQuerySecurityObject RtlNtStatusToDosError KeWaitForSingleObject _allmul IoThreadToProcess PsSetCreateProcessNotifyRoutine ExInitializePagedLookasideList ProbeForRead MmMapLockedPagesSpecifyCache KeResetEvent RtlIntegerToUnicodeString RtlCreateUnicodeString ZwSetValueKey PsCreateSystemThread PsRevertToSelf SeImpersonateClientEx RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsTerminateSystemThread KeWaitForMultipleObjects ZwWriteFile IoDeleteDevice IoUnregisterShutdownNotification IoDeleteSymbolicLink ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList PsDereferenceImpersonationToken _aulldiv _aullrem _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s RtlClearAllBits IoFreeMdl MmFreePagesFromMdl MmUnmapLockedPages ExWaitForRundownProtectionRelease MmAllocatePagesForMdl ExReleaseRundownProtection RtlFindClearBitsAndSet ExAcquireRundownProtection RtlClearBit RtlSetBit ExReInitializeRundownProtection KeTickCount KeBugCheckEx RtlUnwind PsGetProcessId IoIsSystemThread RtlEqualUnicodeString RtlCopyUnicodeString KeGetCurrentThread SeTokenType ExDeletePagedLookasideList PsDereferencePrimaryToken MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite ExGetPreviousMode MmIsAddressValid NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess memmove KeDelayExecutionThread _wcsnicmp wcscpy_s RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer IoWriteErrorLogEntry IoAllocateErrorLogEntry ZwSetSecurityObject IoDeviceObjectType IoCreateDevice RtlGetDaclSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetGroupSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAddAccessAllowedAce wcschr RtlAbsoluteToSelfRelativeSD RtlSetDaclSecurityDescriptor RtlCreateSecurityDescriptor ZwCreateKey ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeQueryTimeIncrement KeQuerySystemTime ExInitializeRundownProtection RtlInitializeBitMap KeSetEvent ObfDereferenceObject IoCreateSymbolicLink IoRegisterShutdownNotification ExInitializeResourceLite ZwCreateFile RtlLengthRequiredSid RtlInitializeSid RtlSubAuthoritySid RtlValidSid RtlLengthSid RtlAppendUnicodeStringToString RtlCompareUnicodeString IofCallDriver IofCompleteRequest IoWMIRegistrationControl RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess RtlHashUnicodeString KeInitializeEvent

hal

KeAcquireInStackQueuedSpinLock ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeGetCurrentIrql KeReleaseInStackQueuedSpinLock

fltmgr.sys

FltGetDestinationFileNameInformation FltDeleteInstanceContext FltGetVolumeProperties FltSetInstanceContext FltObjectReference FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltParseFileNameInformation FltQuerySecurityObject FltReferenceContext FltFsControlFile FltQueryInformationFile FltGetInstanceContext FltCreateFile FltClose FltGetStreamHandleContext FltSetStreamHandleContext FltReleaseContext FltAllocateContext FltReleaseFileNameInformation FltRegisterFilter FltStartFiltering FltCloseCommunicationPort FltUnregisterFilter FltBuildDefaultSecurityDescriptor FltCreateCommunicationPort FltFreeSecurityDescriptor FltGetRoutineAddress FltDeleteContext

Name

.text

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win7/avipbb.cat

SHA256 868a019175ff5b006d50134331db3716b86610732adc8f5c63e3dc8bd1532ca9
MD5 f36e6a50e73e6314e2e86278d752e4c0
SHA1 66d2aa95fe43007565f51fc327d740363a3c57b7
SHA512 ef907672c24137fc9eeabf1a2d8fd7f12610a975c4ee85d4f0e26746be73084de7f0d3ee78c4703f27b6d3cf113af35ca362b12382c784158e6373a4718dc096
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avipbb.inf

SHA256 c75444741b52839a8ff89cb0dc483b6707492b8b67df195fec9610b0b844fa7b
MD5 44d0c248a5303802c341931cac34c81a
SHA1 979dd9a063cd0cb3bebe1ab659cdbe006619da63
SHA512 883513728967ff5c873780642c17e7f0f614c9ab65db643c4f46dedae9940f40c439bd5a06df0ae74a425753d86d0b05099e6bd0539c22733da62059b908a551
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avipbb.sys

IMPHASH 4a6708b112aea0a770a8d553371c7edf
SHA256 a59ad15322e353e99d6dc2a83166a9e9ac560cbf870ac038ad4065212dafd74d
MD5 fa54bc0638395be4b571f5ba3dda1c58
SHA1 2a7139069d6cc475dd008fdcb18359a4585cada9
SHA512 220a0a335674c55d2a3c9a2633477e1770c501e2a0be2b6b59ebb20f8cbdbfbe1acc207efd73d9df85dd889a2d6d6f57ad224ccc298984af9b697c0842cf05dc
SSDEEP 3072:2tpicpY21hip3mt/IN2O6YvLUmXNnPFTu5Q2MSvVeVOF/Qu0zY9Pn3Y:3cpLI92CfXNnP4+2MSgVwB/Jn3Y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

f8:e8:5a:d7:a4:fd:a5:0a:f1:db:7a:b8:76:6f:b7:52:d4:95:02:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Sep 11, 2019

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

159806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_x86\i386\avipbb.pdb

ntoskrnl.exe

IofCompleteRequest IofCallDriver KeServiceDescriptorTable ZwClose ObfDereferenceObject KeSetEvent KeReleaseMutex KeWaitForSingleObject RtlCopyUnicodeString ZwReadFile ZwCreateFile _strnicmp RtlCompareUnicodeString memmove ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject ProbeForRead ObReferenceObjectByPointer PsProcessType PsGetCurrentProcessId PsLookupProcessByProcessId FsRtlIsNameInExpression KeResetEvent KeReadStateEvent RtlAppendUnicodeStringToString PsLookupThreadByThreadId PsReferencePrimaryToken PsDereferencePrimaryToken SeTokenIsAdmin SeQueryInformationToken RtlAnsiStringToUnicodeString RtlInitAnsiString _stricmp PsTerminateSystemThread PsThreadType PsCreateSystemThread RtlInsertElementGenericTableAvl ExDeleteNPagedLookasideList ExDeletePagedLookasideList ExDeleteResourceLite IoDeleteDevice IoWMIRegistrationControl RtlIntegerToUnicodeString ExInitializeNPagedLookasideList ExInitializePagedLookasideList IoCreateSymbolicLink IoCreateDevice ExInitializeResourceLite KeInitializeMutex KeGetCurrentThread _vsnwprintf KeWaitForMultipleObjects ExGetPreviousMode KeQuerySystemTime PsGetCurrentThreadId IoReleaseCancelSpinLock IoBuildSynchronousFsdRequest ObReferenceObjectByHandle ZwWriteFile _allmul _aullrem RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv ObfReferenceObject ObOpenObjectByPointer PsGetProcessId wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy wcsrchr strncpy IoDriverObjectType wcscpy_s KeDelayExecutionThread KeTickCount KeBugCheckEx RtlUnwind RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag ExAcquireResourceSharedLite KeEnterCriticalRegion ExAcquireResourceExclusiveLite ExReleaseResourceLite KeLeaveCriticalRegion memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList IoDeleteSymbolicLink KeInitializeEvent ZwSetInformationFile ZwQueryInformationFile ZwQuerySystemInformation IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite MmIsAddressValid NtClose NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess ZwOpenProcess ZwFreeVirtualMemory ZwAllocateVirtualMemory ZwDuplicateObject RtlImageDirectoryEntryToData RtlImageNtHeader ZwQueryObject ObQueryNameString RtlDowncaseUnicodeChar _wcsnicmp RtlLookupElementGenericTableAvl RtlDeleteElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry

hal

ExReleaseFastMutex KeGetCurrentIrql KfReleaseSpinLock KfAcquireSpinLock KeQueryPerformanceCounter ExAcquireFastMutex

avkmgr.sys

func4 func3 func5 func1 func0 func6 func7 func8 func9 funca func2 funcd

Name

.text

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win7/avkmgr.cat

SHA256 40b23a7d83bd3595a714918778249b6f999c8b016aee814207c893c8aa791e9f
MD5 8dbe5877f742d7d8fb652c84f76fab5b
SHA1 126f9190ef1822764e8d7d16bc14c4f03d0fffa9
SHA512 70fc63d4a4b101829a0e32135562cceb9ddebb36f907c96f01639b29248d4417af98dfa5ec8143e55db4e19c159c4a08a176bbcf2ff17a3ffe4627e7550fccf1
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avkmgr.inf

SHA256 9fedd6e956b7cd59180920ba7a6c94d0c0fa1dee867ed6087ba753ca47d21a37
MD5 e92853f21048c93a182a140e667983e9
SHA1 4265adb15d2f6ed70b7521d3887bd2304528ebef
SHA512 11617cc1fd33066ba4e54be9a174b7b4a610de66712299dbcd379d0f5b2cc4bcb1590c1719867129cac962619d0e04b25a177139a4c6f5b041c9c8711fc1b419
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avkmgr.sys

IMPHASH df68c8435781307135dfe76497ab5341
SHA256 d5e35a021e2a8e676b9034a2c712907f170d3f5b7315d516f317f51cd03ddd06
MD5 20894c53c0b9db8f86993d9ecb78f9d5
SHA1 7c18c5b571c906535d393a5165379f6316143107
SHA512 7fbd637c64a3ed5ce202864197ee26e0d97f84be8bb0bfd5bdbfcf500f370764545489de8d83c347e5f15a414bf5d614377a60983803924935453266f8af5d24
SSDEEP 384:pSxWv2ZhZ4mAjuPUEA1aVrFiFdWeFuu9BTQe7r/nYPLvdJUHeMPP:gS8ZIuPwoz4dWeFuubQEr/KdkP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

0e:11:dc:93:87:33:df:91:40:f0:90:a9:a0:f6:04:da:25:c2:45:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

36926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_x86\i386\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

846B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win8/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win32/win8/avgntflt.cat

SHA256 53d97aa50393ca150fcdec5cc8e301c41c1115de0fd1a5cdfe888bc1ca6c7160
MD5 b8c79e6cfc02b9a0b8b82ed553f9166c
SHA1 376cd0763508ec17c11a3a026f29a9c80b6e6afa
SHA512 a79ffbfd5d1bd99f722a5eda7e61696194c8943c26b1fca183eb524937e3f2b07c20b4de27853adbcf1b1d839ee37f09c575c8f960e847fc3d648495ec81c553
SSDEEP 192:vDnyq1JC0E4uyK6iWPFWQFIiQXNpVwyqnajluGFmbhiT/:t1hiWPFRtkvl4G57
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win32/win8/avgntflt.inf

SHA256 1bb8e4f5c84ef97e6040e85ab0bc6096af0a1e60b1f816b77df2825cfacc7427
MD5 3dd9d84fbb36673790a325616f46ed41
SHA1 a5fe04fc7e312149a6dea0103d64a6330de823b7
SHA512 7380d7b38ac0498d64ade84444ab31bafef40e112cdba24564a899e89d09f5a60d07e423a78de8f6002a5c356665abdaf58c77424035e64a3b5986cdfe46bf00
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win8/avgntflt.sys

IMPHASH 4da638de60b7c35dc73116b3dd0f9868
SHA256 7c4daa6d040aea3ed2f775e1282ff799342d84957e2ad803ff856b414ae478b8
MD5 c051f6d6f9cca6ba44769c9f3c5e08c1
SHA1 fbd708222412f8a93790b6252fc872d6bb285805
SHA512 a85af9258906a683e004daf2f9a022aa3227e4ed1e01b1ba1a7dcbec72c03b89af741404405552f02da48798bd2a47950578ec329557bba644ca45441740d07a
SSDEEP 3072:u4+wW40T059lGsMSQ/YafavrVYublgTUDs32HaLiOd60i9br6:5+w8T05q1QaEVYublg6la33i9C
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

156256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avgntflt.pdb

ntoskrnl.exe

RtlUpcaseUnicodeChar RtlFreeUnicodeString KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion InterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc _alldiv memcmp ZwQueryInformationFile ZwSetInformationFile InterlockedPushEntrySList IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetBit RtlClearAllBits RtlFindClearBitsAndSet ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine RtlAppendUnicodeToString KeResetEvent ExInitializePagedLookasideList ProbeForRead ZwSetValueKey RtlCreateUnicodeString _allmul _aulldiv PsDereferenceImpersonationToken PsCreateSystemThread PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _aullrem _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry memmove RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp PsDereferencePrimaryToken RtlUnwind RtlCopyUnicodeString RtlEqualUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString KeGetCurrentThread wcsncat RtlIntegerToUnicodeString toupper IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors memset memcpy RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeQuerySystemTime KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress KeWaitForMultipleObjects RtlInitUnicodeString

hal

ExAcquireFastMutex KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock KfReleaseSpinLock KfAcquireSpinLock KeGetCurrentIrql ExReleaseFastMutex

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltParseFileNameInformation FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win8/avipbb.cat

SHA256 d657a6d558bf4ffbfd98635d6ed710cb696d014401f239767fea24694c9e6b9d
MD5 e6d91dd3acddb2db9599f14ef8d27ac7
SHA1 fb1f0ce044e7e52494d1cbac481e3a0de986639c
SHA512 8a2661a3523a35919158f4d753f6a8761b73d4f0c584101fed0de91aa02264f3ca412dfd7a2995501f6d66289fde281d9b9b1f73b31c9761782e418c1575c2fa
SSDEEP 192:ZHuERnRdy9kJCWZvgRyK8UFWQFxLQfLux5Dqnaj0CC:ZnRDxR5UFRT3Dl4CC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win32/win8/avipbb.inf

SHA256 fd8f20991375a3b90c28efd32b6f1f3d7a146b442d7045503eccd11b7d841052
MD5 c671a35e5e6fd4f339456282e5f60355
SHA1 7caa5f34177c6506b57244b6f178a3141c6dcdef
SHA512 c5e238f5161894e97c90588c97ae114aa88349ddc5bfa46d78ed7ecb88abca7cd62ea1bcc3fb0d6eb8f1fa5bb3a572a2e9eafecca7f528794f7ba49b7754e4c8
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win8/avipbb.sys

IMPHASH fffb1de604a85c27995466f9f3d4ee66
SHA256 683f4be712e2ebf43605228c922bf8290ac488aeb6217508e76c9762d4ccfe2e
MD5 42acd4d23a3fc8c8a24c98d8ba46006b
SHA1 decec09fdca578b2fd52bd1c154245447d632f1e
SHA512 8f652dcbc65b38e3979fae178e015d721be97bed92fe4bd06d6951a55e263b7a4c10e68454cfb5ada52a376391dd1ac24b1e01e6d16699f472598c0690392d1b
SSDEEP 3072:51tN34a9rnwdmrOxVUvOK/1n4O11bMMQwKiYBlQuugmTi1ZJcL:52gwkNn4OTIMQwK7BlBupm1O
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

172032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avipbb.pdb

avkmgr.sys

func7 func8 func6 funca funcd func5 func4 func3 func2 func1 func9 func0

ntoskrnl.exe

RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite PsCreateSystemThread PsTerminateSystemThread IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId SeTokenIsAdmin SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken PsLookupProcessByProcessId PsLookupThreadByThreadId FsRtlIsNameInExpression memcpy memmove memset KeNumberProcessors PsProcessType MmGetSystemRoutineAddress KeServiceDescriptorTable KeGetCurrentThread KeWaitForMultipleObjects KeQuerySystemTime ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf _allmul KeInitializeSpinLock RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv _aullrem ObfReferenceObject PsGetProcessId ObOpenObjectByPointer ZwQueryVirtualMemory wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcscpy_s wcsncpy wcsrchr IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose ObQueryNameString ZwQueryObject ZwDuplicateObject ZwAllocateVirtualMemory ZwFreeVirtualMemory ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlImageDirectoryEntryToData RtlImageNtHeader RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry memcmp ZwSetInformationFile RtlInitUnicodeString RtlUnwind RtlInitAnsiString RtlIntegerToUnicodeString _strnicmp _stricmp RtlAnsiStringToUnicodeString PsThreadType

hal

KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter

Name

.text

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win8/avkmgr.cat

SHA256 4f7410877d36f20a802c5db603149a33beed2d10e3e83f6c5372e52be42fdae0
MD5 a63897b79888e60e29431eb1b28844de
SHA1 86feb4a8ff0beda3b6c349fbf17c7b6a37e771db
SHA512 b176be196dd4967b28305a4f59325034b8ec4e7b544a2011f8b8f908a8154db8d86a3183e25b22232597024d04bc536d42556df89fea3169f0c21251da27ef9c
SSDEEP 192:3i9X2cACJCztpyKWFWQF82QKZ8fNLyFqnajktKF4m:wAC5FRRte1olwkF4m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win32/win8/avkmgr.inf

SHA256 431367c384e680b0f4feafaf7529319ab2cc3cd37bccd291b46c711fa49204ff
MD5 dddb1f6ae43397a15af280de3ebc3c83
SHA1 2651935088949e2dff211a7c1126a02836a9b781
SHA512 6b5d7715d691d18647d1cdf5e3d3bcaae84fa9614378770d544e0263261b99539977922632acbed76a520aebe045396635e45dec9defa9527500f5889d9e8069
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win8/avkmgr.sys

IMPHASH 915211291455160b181a1b35daf6bd20
SHA256 5fdde96d05b4284fa7ee985a7777739c46040ad89b3b8217a729da9695e3e542
MD5 e3ab0eeb7613ddbacc0388b96048ff5d
SHA1 f6e382597081451d6546339948edd3e854b7dfae
SHA512 40c0c7ac884297350a40d58a6a870796381ccb82ade22d69ca3cb9be0c3251b8768f95ab4b0f28f209ed65aed23894a7e77529316250ace7e5da8a99d0bb81a1
SSDEEP 768:ginpYN85Ry72IqbyReYU6uPwoz4djHIEoF+NdKduH1Qk8AI24o3whJ:BpsK64yRGwospoJFsEuH+k8AH1ghJ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

36864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Bld\128\795\bin\Win32\Release8\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win7/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win64/win7/avgntflt.cat

SHA256 b99e22863acd4f8ae1aa30727e80305d3cce171d67638cc84264bbe796715aab
MD5 c407cd984c328f861a0cc4d0e210eeae
SHA1 fb30aee0ae5f61d40fa2f8c3987ae0d1fa3af698
SHA512 01f15c16dcfff79f9eaed78692b41f01d54d753dffd2547a558ea5ef6286596e5198c70f2a1b6fca951f091ba1ea6b09c5c849a48f87dfda70182fe7969ac492
SSDEEP 192:HEG324UBqpmMBWJdZ2Mf5rfoEXpBjSwnQQTthiO:kLmmJdZ2OfXXpBjZnBthv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win7/avgntflt.inf

SHA256 1bb8e4f5c84ef97e6040e85ab0bc6096af0a1e60b1f816b77df2825cfacc7427
MD5 3dd9d84fbb36673790a325616f46ed41
SHA1 a5fe04fc7e312149a6dea0103d64a6330de823b7
SHA512 7380d7b38ac0498d64ade84444ab31bafef40e112cdba24564a899e89d09f5a60d07e423a78de8f6002a5c356665abdaf58c77424035e64a3b5986cdfe46bf00
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win7/avgntflt.sys

IMPHASH b398f90ffbc660b3ba4ceb9adfec4ec9
SHA256 68585445ed23b1c0270fefb49e1cf29a38c8fe7c92479e7793d237cb67134c34
MD5 cb12d21a7e4c43acb5f000bb035957bc
SHA1 8ac8d5be7b1758626fedab60626c7a09e2a257e7
SHA512 0cf9c598dd76b496b8dc2f33c19bf7023e0e31e3ca63e7667ae57ad563a2b9b612eee0ad79285e050f8e22f873634d6e9e80749800c073761a1766f3a36967b2
SSDEEP 3072:kJfhiNwrOpCnINCLK8WfUGcquO56s5VYLlYRtdyUR8G5nRn/tn2KmxlM:kJfwNnpCIoa8GcqD56w2L6hy08G5WlM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

40:f1:fd:fb:e0:2e:de:ec:bb:f9:ab:f9:d9:0b:8d:45:ef:76:87:e8:83:b2:6e:b1:75:d3:f9:7e:70:b5:e6:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

2f:a1:4a:3c:71:ed:eb:f4:ee:f7:94:c8:5c:d8:d2:52:e4:3a:f5:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 7, 2019

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 5, 2019 - Jun 3, 2020

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

230332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_amd64\amd64\avgntflt.pdb

ntoskrnl.exe

ExAcquireResourceExclusiveLite IoThreadToProcess RtlUpcaseUnicodeString KeLeaveCriticalRegion RtlAnsiStringToUnicodeString IoGetStackLimits ZwQuerySymbolicLinkObject ZwReadFile KeInitializeApc KeInsertQueueApc RtlAppendUnicodeToString RtlInitAnsiString ZwDeleteValueKey wcsncat KeReleaseSpinLock ExpInterlockedPopEntrySList RtlEqualUnicodeString ZwOpenSymbolicLinkObject KeEnterCriticalRegion ZwOpenProcessTokenEx IoCreateSynchronizationEvent SeCreateClientSecurity RtlFreeUnicodeString ZwQueryValueKey ZwQueryDirectoryFile ExAcquireResourceSharedLite ExReleaseResourceLite SeQueryInformationToken ZwOpenProcess toupper PsGetCurrentThreadId RtlCopyUnicodeString ZwOpenFile ZwQueryInformationToken RtlUpcaseUnicodeChar IoIsSystemThread KeQueryPriorityThread PsGetProcessId ZwOpenKey KeAcquireSpinLockRaiseToDpc ZwSetInformationFile ZwQueryInformationFile RtlEqualSid ExpInterlockedPushEntrySList ZwQuerySecurityObject IoFileObjectType RtlNtStatusToDosError NtClose ExQueryDepthSList ObReferenceObjectByHandle IoGetTopLevelIrp RtlGetOwnerSecurityDescriptor KeWaitForSingleObject PsSetCreateProcessNotifyRoutine ExDeletePagedLookasideList ProbeForRead RtlCreateUnicodeString KeResetEvent RtlIntegerToUnicodeString ZwSetValueKey MmMapLockedPagesSpecifyCache ExInitializePagedLookasideList RtlDeleteElementGenericTableAvl PsCreateSystemThread PsTerminateSystemThread SeImpersonateClientEx PsRevertToSelf KeWaitForMultipleObjects RtlEnumerateGenericTableWithoutSplayingAvl ZwWriteFile IoDeleteSymbolicLink IoDeleteDevice SeTokenType ExInitializeNPagedLookasideList RtlHashUnicodeString ExDeleteNPagedLookasideList _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExReleaseFastMutex ExAcquireFastMutex RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl RtlInitializeGenericTableAvl sprintf_s MmUnmapLockedPages ExWaitForRundownProtectionRelease ExAcquireRundownProtection KeReleaseInStackQueuedSpinLock ExReleaseRundownProtection KeAcquireInStackQueuedSpinLock MmAllocatePagesForMdl IoFreeMdl RtlSetBit RtlClearAllBits RtlFindClearBitsAndSet ExReInitializeRundownProtection MmFreePagesFromMdl RtlClearBit KeBugCheckEx IoGetDeviceObjectPointer _wcsnicmp KeDelayExecutionThread ZwQueryInformationProcess wcscpy_s RtlInsertElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry IoCreateDevice ZwSetSecurityObject IoDeviceObjectType _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor RtlAbsoluteToSelfRelativeSD IoIsWdmVersionAvailable SeExports wcschr RtlAddAccessAllowedAce RtlGetSaclSecurityDescriptor RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor ZwCreateKey PsDereferencePrimaryToken ExDeleteResourceLite PsDereferenceImpersonationToken PsGetCurrentProcessId ObOpenObjectByPointer ZwClose IofCallDriver RtlLengthSid KeNumberProcessors ExInitializeResourceLite ObfDereferenceObject IoCreateSymbolicLink RtlCompareMemory RtlInitializeSid RtlCompareUnicodeString IofCompleteRequest RtlAppendUnicodeStringToString KeQueryTimeIncrement IoGetCurrentProcess ZwCreateFile ExInitializeRundownProtection RtlInitializeBitMap RtlValidSid RtlGetVersion KeInitializeEvent MmGetSystemRoutineAddress KeSetEvent RtlInitUnicodeString InitializeSListHead IoRegisterShutdownNotification IoWMIWriteEvent ExFreePoolWithTag IoWMIRegistrationControl ExAllocatePoolWithTag RtlLengthRequiredSid IoUnregisterShutdownNotification RtlSubAuthoritySid __C_specific_handler

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltSetInstanceContext FltDeleteInstanceContext FltDoCompletionProcessingWhenSafe FltGetFileNameInformation FltSetStreamContext FltCancelFileOpen FltGetStreamContext FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltParseFileNameInformation FltQuerySecurityObject FltReferenceContext FltFsControlFile FltClose FltQueryInformationFile FltCreateFile FltGetInstanceContext FltReleaseFileNameInformation FltAllocateContext FltReleaseContext FltSetStreamHandleContext FltGetStreamHandleContext FltStartFiltering FltRegisterFilter FltBuildDefaultSecurityDescriptor FltGetRoutineAddress FltCloseCommunicationPort FltUnregisterFilter FltFreeSecurityDescriptor FltCreateCommunicationPort FltDeleteContext

Name

.text

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

19B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win7/avipbb.cat

SHA256 a1a3ccc5feea86aa08dd19b4717913df9430996a04fa444eb9f44456b8cd6ad5
MD5 f7139f2ba9a6ffa9e1d3c0c1b4dca506
SHA1 ccaad0fa94a251706b7f4156e47a9cdeedb12dcf
SHA512 ab9e2cf766c1acc21a7d26364be2aa62183cb6e38795dd6990df87f80956cebca0a23c2fbecdd3795ec6efcf301a845c63beda6f58a64b270ef685aa78c08ccf
SSDEEP 192:avV32ZYC6a1Yd3wZdZ2Mf5rfoEXpBjSwLQ2wx:avJC6MPdZ2OfXXpBjZLM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win7/avipbb.inf

SHA256 4cf97cbe014d1c1f3afcbe6f2534e0536fb1bbe42c42bb096f35c86b239109f5
MD5 cad7c5e0e6a37588061084878c0a7e2e
SHA1 13c7bbbfd58edd4fa8d9b6565e8274fba7b65c98
SHA512 20b9a0a0e182db1e29fa53f734ca054c85b02218e82ab81b8db140b3e3975fbdc3d0fe5c53ab925025ed011d50a7ab4945670aca1ca54fd393d2fc8bc44e5825
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win7/avipbb.sys

IMPHASH 03ab424c5032a15c20d0c7b3945b6abc
SHA256 05fd91ca74c7d6549b95c590fc2806087b2a70c293a70474de62c53d65f0d8e8
MD5 056c365df7a98ad0e67616ef14444f4a
SHA1 9c15d77ad5bd5fa247cfbe09d21246def22cc86f
SHA512 c6bcc81b7dd6a4530846cb8ce209c74de3342b55b09b69e29e8906eb68eed75eed6446f43f5c6fa3c353a27f0afe0e90c1bb77366cb9aa72fbe74729d475722e
SSDEEP 3072:1OfS4igtz86CkVkzDmVSbYLsEXei/W9Quxyh67:M1Np86CBdb3i/EBD7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

fa:55:ca:9a:0a:0c:c6:54:1d:4e:25:b4:be:94:62:c1:a4:f4:f8:53:e3:5b:23:02:d0:4f:c1:85:15:6a:33:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

e7:d6:ea:79:ae:67:98:bd:a0:4b:53:bd:ee:99:25:8e:c5:b6:a1:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Sep 11, 2019

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:86:db:2a:87:44:f4:39:4c:a4:00:00:00:00:00:86

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 5, 2019 - Jun 3, 2020

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

176228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_amd64\amd64\avipbb.pdb

ntoskrnl.exe

KeReadStateEvent KeInitializeMutex KeLeaveCriticalRegion RtlAnsiStringToUnicodeString ExInitializeNPagedLookasideList ExAcquireFastMutex PsLookupProcessByProcessId ZwQuerySymbolicLinkObject ZwReadFile RtlInitUnicodeString RtlIntegerToUnicodeString IoDeleteDevice KeSetEvent PsReferencePrimaryToken ExpInterlockedPushEntrySList MmGetSystemRoutineAddress KeInitializeEvent RtlInitAnsiString RtlGetVersion ExpInterlockedPopEntrySList ZwOpenSymbolicLinkObject FsRtlIsNameInExpression KeEnterCriticalRegion KeReleaseMutex ZwCreateFile ExDeletePagedLookasideList ExAcquireResourceSharedLite IoGetCurrentProcess ExReleaseResourceLite ZwClose RtlAppendUnicodeStringToString IofCompleteRequest ExQueryDepthSList SeQueryInformationToken KeWaitForSingleObject RtlCompareUnicodeString RtlCompareMemory ExDeleteResourceLite IoCreateSymbolicLink PsGetCurrentProcessId RtlCopyUnicodeString ExReleaseFastMutex ObfDereferenceObject IoCreateDevice ExInitializeResourceLite KeNumberProcessors ObReferenceObjectByPointer ExDeleteNPagedLookasideList PsLookupThreadByThreadId PsDereferencePrimaryToken IofCallDriver IoBuildSynchronousFsdRequest ExGetPreviousMode _vsnwprintf ObReferenceObjectByHandle PsGetCurrentThreadId KeWaitForMultipleObjects IoReleaseCancelSpinLock ZwWriteFile KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl PsThreadType RtlEnumerateGenericTableWithoutSplayingAvl KeAcquireSpinLockRaiseToDpc wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy strncpy IoDriverObjectType wcsrchr PsGetProcessId KeDelayExecutionThread KeBugCheckEx KeResetEvent IoWMIWriteEvent ExFreePoolWithTag IoDeleteSymbolicLink PsProcessType IoWMIRegistrationControl ProbeForRead ExAllocatePoolWithTag SeTokenIsAdmin _strnicmp RtlInsertElementGenericTableAvl ExAcquireResourceExclusiveLite ExInitializePagedLookasideList _stricmp ZwSetInformationFile ZwQueryInformationFile _wcsnicmp RtlDowncaseUnicodeChar ZwQueryObject ZwQuerySystemInformation ZwOpenProcess ZwQueryInformationProcess RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry __C_specific_handler

hal

KeQueryPerformanceCounter

avkmgr.sys

funca func8 func5 func0 func2 func7 func1 func4 func6 func3 func9

Name

.text

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win7/avkmgr.cat

SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
MD5 f3324c2c121d360f8ce3553e221c3ce6
SHA1 85939054d39067cc7e1089de71138b4b4283f800
SHA512 045db8fab56ab1c4ff0cea326cd44624c3bbab2d042b3065541707bec0021b669e6a49fcb2adf502fbea38dd4823e85fe0f2c588f93efeae4108239ae1271c78
SSDEEP 96:SZR2gYJUzSDaSDqhRwUWcGDvbop6WDfeRDUzxwLhPjkFokPXhVEM0YDfez6rEfga:S32HmX0c0YWEhV0+3Ef5KYpBjSwrQa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win7/avkmgr.inf

SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
MD5 176af3c43b608af665f48a35f497bae1
SHA1 e992df632b9758b3df7b4ea69c632f12a03daaf6
SHA512 03cec71f9ca56d99304b6dff1b90a2ca5d04bf5cf7cd0e41e1134cdb1cac50540d6e3bec18313f970420af4bf29d76653e9c5a9fa1351d1747989dfafc208493
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win7/avkmgr.sys

IMPHASH bbbf29be00d696bbac6e5abddd6e312c
SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
MD5 eb5c2402e2f402a19504bf6ca9c3e06a
SHA1 63aa9690c36d743951558422d841276c25cde77d
SHA512 9b6b7c06e904cf36aefc17e14a108e9636c3a8920a34960dcb26fa520326c7ff47f03c24bacaec6ba91440237fb16afde0df01c299cdd7a89c40cc489a3f0151
SSDEEP 768:p5UbgvCkoe+nuPwoz4dC2xfDKKdqe0nKUbZ:88axeLwos42xfDpqevq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

67:03:5e:7d:2d:97:2d:65:2b:25:6f:b7:39:13:c4:12:e0:cf:0a:5f:c3:7f:d1:d6:5b:ce:39:2e:35:ec:d8:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

5a:6a:8a:38:66:a5:ea:f2:62:5c:0a:0e:de:29:fb:20:b7:df:d1:db

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2018 - Sep 20, 2019

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

32868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_amd64\amd64\avkmgr.pdb

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

406B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win8/avgio.dll

IMPHASH 5a8cd279b401a956e2a29f99e8d63e4f
SHA256 17da8784b1997f65bde40ee74f1d0ea40428cee617031220ea9ead660749c03c
MD5 73100a6909fe7f7bcd800e1729eba2da
SHA1 6630a3e72aac3ea441997951ba1f9511316f432a
SHA512 ec1e26445f3f6694fb3d70904b4f1f62143366c38785655feb72859d7fecf9b62021b4d9dea77340d2f154b649ef173d783a2fccdfe2aea24e3dd7883a6dcc5c
SSDEEP 3072:fkPbqLGZyde93OwdCQlESIxdSILiOIFhYlNDPFxM6A1juWCKAeq:cPHZyY9zJlD+dhkhCNSKzKlq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

65:9f:96:6e:91:94:f6:44:c4:e1:d2:85:72:1b:58:d6:f2:e6:14:ab:54:3d:9f:1b:d6:45:41:d5:f0:ee:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 21, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

35427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx GetDriveTypeW QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile SetFilePointer WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl SetLastError GetLastError CloseHandle CreateFileW SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW MoveFileExW HeapValidate GetConsoleMode GetFileType GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess HeapFree HeapAlloc GetStdHandle CompareStringW LCMapStringW GetProcessHeap SetStdHandle MultiByteToWideChar GetConsoleCP HeapReAlloc GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW FlushFileBuffers GetTimeZoneInformation HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win64/win8/avgntflt.cat

SHA256 1e68db7ab6df620cf8c9d7ea80275925df982e4ad3d513eeec758c85477f89dc
MD5 aec89e04f905d6cbbf96c4dda500a37d
SHA1 e1bc37bf9f28a259d4bfee41170a34c82170fafc
SHA512 f5d5b33fd394d0e9d2a0763dfb47a3614e13047eaa768e8be9425add64d501ff3607c7d92e52c2257793f108203a1cfc1252e286201653d950e2d4fcb9ecb233
SSDEEP 192:VDvyQJCkE4uyK6iWPFWQF8oQQ9i5M8xOSqnaja94G1:NBiWPFRzxPCTlOmQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win8/avgntflt.inf

SHA256 1bb8e4f5c84ef97e6040e85ab0bc6096af0a1e60b1f816b77df2825cfacc7427
MD5 3dd9d84fbb36673790a325616f46ed41
SHA1 a5fe04fc7e312149a6dea0103d64a6330de823b7
SHA512 7380d7b38ac0498d64ade84444ab31bafef40e112cdba24564a899e89d09f5a60d07e423a78de8f6002a5c356665abdaf58c77424035e64a3b5986cdfe46bf00
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win8/avgntflt.sys

IMPHASH 405842826b83b55c6c2db2fb9269856f
SHA256 d7e219b7d9e49fab68d06b21e88371645756045aa30081701d98751259da6b99
MD5 654fe9c2688b07c2eb14d12a52736e7b
SHA1 4f96d0cc4391913239f5c1bd090e050dbb90876f
SHA512 ce43a12921ca8ea3c05c69c55ad8c99b5863d609989aacd46ba7f9bffdbf07f78ff18cfbce8436181fea88b08fac8b3b9010770ced47e3a4ec7b021bee67551f
SSDEEP 6144:eDNH/pU01GDgY343CjRcc+bOgIi7PxfMPtpwkJmB:eDNBU01GD/1nAOgIi7PLKc
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

201392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avgntflt.pdb

ntoskrnl.exe

RtlInitAnsiString RtlAnsiStringToUnicodeString RtlEqualUnicodeString RtlCopyUnicodeString RtlAppendUnicodeToString RtlUpcaseUnicodeChar RtlFreeUnicodeString KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock ExpInterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc ZwQueryInformationFile ZwSetInformationFile ExQueryDepthSList ExpInterlockedPushEntrySList IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetBit RtlClearAllBits RtlFindClearBitsAndSet KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine RtlIntegerToUnicodeString KeResetEvent ExInitializePagedLookasideList wcsncat ZwSetValueKey RtlCreateUnicodeString __C_specific_handler KeWaitForMultipleObjects PsCreateSystemThread PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExAcquireFastMutex ExReleaseFastMutex RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp toupper IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey PsDereferenceImpersonationToken PsDereferencePrimaryToken SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite InitializeSListHead ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress ProbeForRead RtlInitUnicodeString

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltParseFileNameInformation FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

3B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win8/avipbb.cat

SHA256 0ef3651a0b3fda24e18943675fc642f5b540f4cdd495e3d17fc2cc7d62b91c60
MD5 5f7c6c06ca7cbe76ff1132b5b5db171a
SHA1 70781589e998494b46075e37dc65a848ffecd811
SHA512 f1927fe5e03fc3fdaad0cfa9a2f2d7371c6c44c4f8b08734f8d00545453555a7c12d7fef3ea97aaf77fb0c7b0a48a5a440bb837104c1c378b2309cb4915d6745
SSDEEP 192:CH7RrR9ylEJCmZvgRyK8UFWQFx/Q5NDUtpwBqnajrQmVx:CVl7RR5UFR3UWqlAm/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win8/avipbb.inf

SHA256 99fac6d236147986d206b2b69873b9de8f156b1fb3d909c57ff33954fc5afd0d
MD5 d140a56472b7b1aa65d2823738edcb81
SHA1 60bd23215fe6cf9a7891ee26a0129994839faf9a
SHA512 2192c3d5a8e7e8ea7a443237aacc401ac0b68b7c47cf610a989776082ded4286954ed84313390fcdcf990f46391aba462a9c6f62f8d9162b09bb18fdf6ef7b93
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win8/avipbb.sys

IMPHASH 7faea936002c5a479c9aa12684780345
SHA256 a257e4e9a10658a1f5d7a98b6e29f678ffcf7208fd0a75cf92576cb1a1585e2b
MD5 5b1de9574012d42c29a051f862a9f185
SHA1 d577e6cb54ab788fd093d3b6675ae8e23d5733b6
SHA512 d151ce55153c32c32fece8e9589adb862af98b06d47793a03d540411066defb05f834a665f389ee18e173b64853e81fd63872ccc109fa82ab3c20e854906468b
SSDEEP 3072:d9tiEzBdPGc85RQlzKsmXkiVP/qAS0qwvHLcaQuB0Gs7Bgr:dvD8GGx/00qwvQaByV9a
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

188416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avipbb.pdb

avkmgr.sys

func2 func3 func4 func5 func1 func7 func8 func9 funca func6 func0

ntoskrnl.exe

RtlIntegerToUnicodeString RtlInitAnsiString RtlInitUnicodeString MmGetSystemRoutineAddress RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag ExAcquireFastMutex ExReleaseFastMutex ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId SeTokenIsAdmin SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken PsLookupProcessByProcessId PsLookupThreadByThreadId _stricmp __C_specific_handler KeNumberProcessors PsProcessType KeWaitForMultipleObjects ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsThreadType wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcsncpy wcsrchr PsGetProcessId IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose ZwQueryObject ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry wcscpy_s ZwSetInformationFile _strnicmp FsRtlIsNameInExpression

hal

KeQueryPerformanceCounter

Name

.text

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win8/avkmgr.cat

SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
MD5 88ae7b9879c9ac3a65ef73424600ba65
SHA1 67f74e5f569aed30bda54b5a6467d86d0110e448
SHA512 5b87166c206dee390e81a3ad334578a9b1ca7274b677af3cfeb2c6cfe46b756a59df78b0ea5ab7c1e11d3465f5955e58bac8dd45daeda61ac683ae53388c3dc8
SSDEEP 192:niBT2KJC2tpyKWFWQF8ESQ85SD7Zqnaje1cwrxFh:+mFRTS9Ell61cwrxn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win8/avkmgr.inf

SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
MD5 fabaac0d5c0ef083150dec8615a8b2bb
SHA1 23b864f150922bd020b679e018b1b0ee59a7353f
SHA512 51cac3b029a5ec11ba36e8b7ad86b720da7e6546cb4ba8cad319200892ff143e9664e4a29d915a79f4a302b15078e44f0bc934715b8fcf8deaef4d7e3dde5801
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win8/avkmgr.sys

IMPHASH 1a89cb31ddbe098dfbe56321442ce0b1
SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
MD5 40786e1ac650f9f7e8b67a672b5eb69e
SHA1 f529c7b666b029e19a301a30463abcadd59f4b0b
SHA512 da8453b4d97dc4994a6db2fbdb741119513bd007078bc352b664f77790a7c7de876f038943cf826dbab81962bc5551f506dc04e7d69945bf324f3a23a5e9e6ba
SSDEEP 768:Z6e6av+nuPwoz4d0ggKdeql0dsKI2Nr3h+1y:ZuavLwosugz3aHR3h+s
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

32768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\Bld\128\795\bin\x64\Release8\avkmgr.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

342B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/plg_fops_dummy.dll

IMPHASH 6e6a20127c71bd569afdd3603c699d26
SHA256 861dd01a5ea887b63a0c4f03da845d8a56962470dfb5721914b5e59d718aff49
MD5 a3be5b7d616f9353bf9cc25b6bb53df1
SHA1 4900434b9836705cda97c76f31abc109d040328f
SHA512 6de5f3396ef23bfacdd8fcffb1710cf36aafc7af929db0c20e38a2e6cf19f00a6b3b832c7562244c9bdce8d78ec093596a3d0ce994c4593424bf1eff1de5cc8c
SSDEEP 3072:49EflB35SR4AmoiEjToSyrgLZuQk9o7vnaOFx5+m:sE7hAIGBLZuQkuFT+m
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

6692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\r5hd573d\utils\SDK\examples\cmake\advanced\plg_fops_dummy\plg_fops_dummy.pdb

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType CloseHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetCurrentDirectoryW GetFullPathNameW MultiByteToWideChar CompareStringW LCMapStringW SetStdHandle GetStdHandle FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation GetStringTypeW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW DecodePointer

SAVAPI/productname.dat

SHA256 9fa0b63b2c5e1a81a6e7b1d6d351fb845c23fd4d67b8c870b9a850ff0e1fdd12
MD5 7d05bf5029c22f26a9ab1de66f254c2c
SHA1 158e3ee360485045be46d4de9cc940437976dc40
SHA512 9021ddc6de0b842a043c3d67aa652001ebc78afe7472b391393bd78e49e04a9ef62dc63eb8377a1c0d8d8518f323b320e64df2962e6e7b36f825ca096291cfb9
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi.conf

SHA256 8675d81b5034235ab6cd8be2556d146b1b713534b6bc850af5e1378b5ce4db0a
MD5 c7ea6cb9e75ec33d0053a4563e4f4822
SHA1 c370b6b31066ab884b42b7830efc18e7d871ef45
SHA512 b960ce8d780e4de419f60e917777c70dc1a991515e26011025c0c2cd2933ac4cfcbe0f272ce38cf7bcb3612a7dd6daebba40e043c17844dfa56c74094ea573c5
SSDEEP 768:DjOPeA2HF0O/qHJTWMmIAY8jr5+6OpQOSV68a:BAQdo5XWY6OpQOSV68a
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/savapi.dll

IMPHASH 4d69623e0252403fd8c9a1ebee67d564
SHA256 2659db9966b5b70a42c5b973443d6e1f633156e3a9538612397a6127e87c92da
MD5 0d3d6248b08ae3601ec2241fb71ddcf8
SHA1 ebce807730af996834b1998c537123c9284ead1d
SHA512 04c19b8e778abba00e7e6a913097731919e76ebbfb70fc4ff9f6b2b620889c0b579e7c5d6e47da0a5cf370258db84883955ee8a71aca53de9e6a7b1fd28b426f
SSDEEP 49152:JZ7VuSiBHQ0xQgg7anyhBaee6zwK5Z5ERUh5MHSPZC2GNCRgSwJE9:JZ7VuVHnQgg7anyhBaZYZ5DERqiHCC25
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8f:07:6c:ab:43:2f:b2:0c:0b:0b:4c:83:f4:1e:5f:44:d2:2d:7e:3c:0e:73:ff:6a:f1:c8:57:fb:b2:09:ed:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

2007624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\libsavapi\daemon\libsavapi.pdb

ws2_32

WSASetLastError WSAIoctl inet_pton send recv inet_addr WSAStartup setsockopt ioctlsocket WSACleanup WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getnameinfo freeaddrinfo getaddrinfo getservbyname htons htonl getsockname getpeername socket shutdown select ntohs listen getsockopt connect closesocket bind accept __WSAFDIsSet ntohl gethostname WSAAddressToStringW WSAGetLastError gethostbyname

mswsock

TransmitFile

rpcrt4

UuidCreate

shlwapi

PathFileExistsW PathRemoveFileSpecW PathCanonicalizeW

kernel32

MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CloseHandle GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW QueryDosDeviceW InitializeCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetStdHandle SetStdHandle CreateFileW DeleteFileW SetFilePointer DeviceIoControl GetOverlappedResult CancelIo MoveFileExW FlushFileBuffers ReadFile WriteFile PeekNamedPipe ReleaseSemaphore CreateSemaphoreA SetLastError GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW CreateDirectoryW FindNextFileW RemoveDirectoryW GetCurrentProcess GetCurrentThread OpenFileMappingW FormatMessageA DuplicateHandle SwitchToThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent SetHandleInformation GetTempPathW CreateFileA GetVersionExA GetModuleFileNameA LoadLibraryA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA FormatMessageW GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LoadLibraryW CreateEventW VerSetConditionMask GetEnvironmentVariableA CompareFileTime WaitForSingleObjectEx MoveFileExA GetModuleFileNameW GetLastError DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GlobalFree VerifyVersionInfoA GetSystemTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedFlushSList RtlUnwind RaiseException GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleCP ExitProcess SetConsoleCtrlHandler HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetTickCount GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency SleepEx InitializeCriticalSectionEx CreateHardLinkW CreateFileMappingA GetCommandLineA GetProcessHeap GetStringTypeW HeapSize GetVersionExW GetNativeSystemInfo GetCommandLineW

user32

GetSystemMetrics GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

RevertToSelf CheckTokenMembership FreeSid CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus DeregisterEventSource RegisterEventSourceW ReportEventW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl AllocateAndInitializeSid InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW RegSetValueExW RegCreateKeyW RegCloseKey

shell32

CommandLineToArgvW

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

crypt32

CertGetCertificateContextProperty CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertFreeCertificateContext

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

CharToSTCHAR SAVAPI_APC_cache_operation SAVAPI_APC_get_version SAVAPI_APC_initialize SAVAPI_APC_uninitialize SAVAPI_FPC_disable_preinit SAVAPI_OA_create_instances SAVAPI_OA_initialize SAVAPI_OA_start_scan SAVAPI_OA_stop_scan SAVAPI_OA_uninitialize SAVAPI_TCHAR_free SAVAPI_char_free SAVAPI_create_instance SAVAPI_engine_modules_get SAVAPI_engine_modules_get_ex SAVAPI_engine_versions_get SAVAPI_extract_malware_names SAVAPI_free SAVAPI_get SAVAPI_get_dynamic_detect SAVAPI_get_fops SAVAPI_get_instance_pool SAVAPI_get_type SAVAPI_get_user_data SAVAPI_get_version SAVAPI_global_set SAVAPI_initialize SAVAPI_is_running SAVAPI_is_running_ex SAVAPI_register_callback SAVAPI_release_instance SAVAPI_reload_engine SAVAPI_reload_engine_ex SAVAPI_reset_instance SAVAPI_scan SAVAPI_send_signal SAVAPI_set SAVAPI_set_avpal_init_flags SAVAPI_set_avpal_inited SAVAPI_set_ex SAVAPI_set_fops SAVAPI_set_log_callback SAVAPI_set_quickload_init SAVAPI_set_user_data SAVAPI_simple_scan SAVAPI_uninitialize SAVAPI_unregister_callback SAVAPI_with_encoding_get STCHARToChar STCHARToString STCHARToTCHAR StringToSTCHAR TCHARToSTCHAR _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4 asc2bin bin2asc bin2hex hex2bin

SAVAPI/savapi.exe

IMPHASH b2c0c973d5f09d420286375ac5b4de47
SHA256 89a60761dcc3fc59a8a672c630f46a0d1e0626b04b5913c95a7a8505ed1e76fa
MD5 7a0231994dbcb4fa2eb0e7817e7a18ec
SHA1 0440be78bc953e2a47a963c756702148829ca352
SHA512 6b33ece73befbc1d53881418d23d3b8b132de07d5659df5044d9509a3fe091c27c4613d01c14ce5a3dd0ff8b21cdd1642409313d3d9239e92fb5d78bc4273ae0
SSDEEP 12288:fSKMPLjpGKVYy27/jB/4IuLMAQNKV5ft1JDHcFkouvmW97EDnw1Xak/Y58a0cSn2:rALjpGKVYL1l+Zt1JDH/PEDnw1Xar6nx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

87:b6:a1:5d:1e:1c:45:0f:7b:6f:f2:d1:00:3e:ea:30:9e:b0:ec:5c:b5:d0:ca:4e:69:b2:8b:f0:61:19:45:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

382555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\src\savapi.pdb

ws2_32

setsockopt getaddrinfo getservbyname htons htonl freeaddrinfo getnameinfo send recv inet_addr getsockname ioctlsocket ntohl socket shutdown select listen connect closesocket bind accept __WSAFDIsSet getpeername WSASend WSARecv WSAGetOverlappedResult sendto recvfrom ntohs WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

shlwapi

PathCanonicalizeW

kernel32

DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW CancelIo SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcessId GetTempPathW GetModuleFileNameW SetLastError CreateHardLinkW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW Sleep GetTickCount GetStdHandle GetConsoleScreenBufferInfo GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SetHandleInformation GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation ExpandEnvironmentStringsW GetCurrentProcess FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle ReadFile GetFileType GetFileTime ConnectNamedPipe SetFileAttributesW SetFileTime LocalFree SetStdHandle DeleteFileW SetFilePointer DeviceIoControl GetOverlappedResult MoveFileExW LockFile LockFileEx UnlockFile UnlockFileEx FlushFileBuffers PeekNamedPipe CreateFileA CreatePipe CreateNamedPipeA CreateDirectoryW FindNextFileW HeapSize SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA DuplicateHandle SwitchToThread GetCurrentThread TlsGetValue TlsSetValue GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree OpenFileMappingW GetEnvironmentVariableW SetEnvironmentVariableW CreateFileMappingA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess GetVersionExA GetModuleFileNameA LoadLibraryA UnhandledExceptionFilter CloseHandle CreateFileW SetConsoleCtrlHandler GetLastError SetUnhandledExceptionFilter IsProcessorFeaturePresent GetFullPathNameW WriteFile QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount RaiseException GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleMode ReadConsoleW ExitProcess GetCommandLineA GetConsoleCP HeapFree HeapAlloc CompareStringW LCMapStringW HeapReAlloc DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetStringTypeW GetProcessHeap SetConsoleMode ReadConsoleInputW GetFileSizeEx RemoveDirectoryW

shell32

CommandLineToArgvW

advapi32

CryptReleaseContext LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA PrivilegeCheck OpenThreadToken GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExA LookupAccountNameA LookupAccountSidA IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority EqualSid OpenProcessToken StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegOpenKeyExW RegSetValueExW RegDeleteKeyW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptAcquireContextA

SAVAPI/savapi_post.bat

SHA256 32b7a45aa617824e689117ff5cdb4641e15c8a3e44dd3d2c7e1a6b339668cb4e
MD5 beff803a30f96deaa30ccc67c1f1b8e2
SHA1 4a95e73d94fdd8de53d3b6cc202a58c676453499
SHA512 782db36522cc59b8f3b860501e85a680e002932ac9d3f46cb7a10da915c2d17c34f0f0c35991a7c35742c584e277712514f1ee66531aff8bac7241c5be63eee3
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi_pre.bat

SHA256 0a8e1189c0111047676f9615fba85b70738ea2d5f3e6323a35fbced61ece5523
MD5 fa64c737cb2e55539c0e94ad3da8502c
SHA1 7180342b8adbe3486a98f0716ba80b906e8a1e38
SHA512 596f0758df96f85f90700a237f8bfc5da2ef3332ff72cc9a9df26e307e5148dc2d23a589c9d9205af27b32ef771536f416847122b4a0d3d46c7d97fcf365ee39
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi_pretest.bat

SHA256 cde8920adab251a2aa003785ba61ab1e022b52e86904c6cdb6b41cc60a04160d
MD5 1a5095ba4345a2aab940d72da9b7e076
SHA1 e99d84ddb548804d0fdaa1dc2c3b61ab73fa387d
SHA512 19cfc2ed97c161533907afd02aa00ba8eca58e26f31cee3a49675e8aea5cb4a4e5167fde4edef69fa228f41bb24540aed8d77f24c9c6187ba0147bace288b7bf
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi_restart.exe

IMPHASH bb514035bec9282b23f2c63992fa7c65
SHA256 5f661a09f517aaf8344f43864678e9b7a4c63574e9ec070ca749ad79e9c96fe5
MD5 f7853307bfef49d66a8cdf556ab6b2e1
SHA1 66ed9129b795ebda8c4e0107c75a6e8f469572b9
SHA512 0d041fcde35c8fddbfc9c186cbed22e2db1fa2634fb02c7a4bc8e1ea4136f2c8322df263c3b887bd96fe902767a9fed92ed0a0e6f1309c2061854c88b66428c5
SSDEEP 3072:a59MHkUtVPvBLBXjKVqxzMM4iGBiysOBC2cTtjpTebk8PC+1zJHaGVYRw3gn:MWVBBmqdghBitF46JR22
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

7a:2f:f3:37:83:28:30:52:5c:5f:b7:36:af:22:80:97:87:59:4c:2a:a5:e8:10:ed:42:db:e7:ee:17:10:21:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

8052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\utils\forupdater\savapi_restart\savapi_restart.pdb

kernel32

WriteConsoleW GetTickCount Sleep FormatMessageW LocalFree CreateProcessW GetExitCodeProcess WaitForSingleObject GetLastError CloseHandle CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc DecodePointer

advapi32

StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle

SAVAPI/savapi_stub.exe

IMPHASH 03f4339e9d4921ee94b76cfcc6539613
SHA256 1d87f3eb55e3b8a241e5790c2c64c41d1e74833764e190b0b65b7f66b461a34c
MD5 7e26af01272bb1f224494431ebb99e8d
SHA1 0b6e1dc5eb76f6d8f66669adf3d635c40610c56d
SHA512 3964e759e1335597180ce8a1d37869a1d8ed59f1075129fa4e246e782161d3798d4d887ede4b44c4fe70e3938d0f0594357a691981e3c45fc2291a018486c8cb
SSDEEP 6144:QbgJlyvV0gIHo7c7L5oLkQ7Wp39WDFp3p1aQ2i8PIQ8ol8EhErFjEmrtHs4+sDsj:QbgJliygIHoXTe9WD73p1aQ2i8PIaljX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

f5:33:4a:05:15:5d:6c:fb:03:cb:4e:a9:e9:69:7c:23:bc:86:e9:2b:a9:fd:9c:fe:b7:40:ee:0c:89:4b:49:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

1

Major OS version

6

Entry point

127520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\e4jp5i63\utils\forupdater\savapi_stub\savapi_stub.pdb

ws2_32

getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername gethostbyname socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept ntohl WSAGetLastError WSACleanup WSAStartup gethostname

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW RaiseException LoadLibraryExW GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetLastError GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW GetStdHandle CloseHandle GetHandleInformation SetHandleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW ExitProcess SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW TryEnterCriticalSection SetEvent ReleaseMutex CreateMutexA CreateEventA FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapSize GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent TerminateProcess CreateFileA CreatePipe CreateNamedPipeA GetVersionExA GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer GetConsoleCP GetConsoleMode FindFirstFileExW GetStringTypeW GetProcessHeap SetFilePointerEx SetFileAttributesW SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

SAVAPI/savapiclient.dll

IMPHASH 7b047355bb875c04977e75246edcb6d0
SHA256 bf65f1dc80d106f33e0ab96e40aca2ee290b2c87096878e0f767e9729c48d613
MD5 3e9ebcd9bb281829e8dde4e591536699
SHA1 62b66e57e4e63bd657eb7a17a4c846b57d378d9d
SHA512 93b6b2c19cbd51d0a2b51f35d980decad84f696e438eaf7710662555ccdd5f5c1e05ae2078c475b6a350e94ab7b2b38d9814209635b56eb30581e0aa080c1238
SSDEEP 6144:t4GQ4ev2NeV3yKN1fnG8YzpZryn/2k6WumOc4a5xbzjvLSsHoDlE+A7cTVqxd0f4:CGQ4ev2NeJyKN1fnG8QS/2kjzbzjvfHR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

34:f5:83:da:45:e1:a5:58:fa:8f:12:5a:bf:d6:be:15:66:c3:33:73:20:77:50:52:9c:c0:f5:d5:90:b1:42:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

1

Major OS version

6

Entry point

176244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\libsavapi\client\libsavapiclient.pdb

ws2_32

recv inet_addr setsockopt send freeaddrinfo getaddrinfo getservbyname ntohl htons htonl getsockname getpeername ioctlsocket getnameinfo WSASend WSARecv WSAGetOverlappedResult sendto recvfrom socket shutdown select ntohs listen connect closesocket bind accept __WSAFDIsSet WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

advapi32

GetNamedSecurityInfoA RegisterEventSourceW CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW DeregisterEventSource GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW

kernel32

GetModuleHandleExW RaiseException LoadLibraryExW FreeLibrary WriteConsoleW RtlUnwind InterlockedFlushSList GetModuleHandleW GetStartupInfoW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW DecodePointer IsValidCodePage GetCPInfo SetEnvironmentVariableW GetConsoleCP GetConsoleMode FindFirstFileExW FindNextFileW GetCommandLineA GetProcessHeap GetStringTypeW SetFilePointerEx InitializeCriticalSectionAndSpinCount GetOverlappedResult SetLastError CloseHandle GetLastError GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetHandleInformation WaitForSingleObject CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA GetCurrentProcess GetCurrentThread OpenFileMappingW GetStdHandle SetStdHandle CreateFileW DeleteFileW GetFileInformationByHandle SetFilePointer DeviceIoControl HeapSize CancelIo MoveFileExW CreateHardLinkW FlushFileBuffers ReadFile WriteFile PeekNamedPipe GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA ReleaseSemaphore CreateSemaphoreA DuplicateHandle SwitchToThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess CreateFileA GetVersionExA GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA IsDebuggerPresent InitializeSListHead QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

shell32

CommandLineToArgvW

SAVAPI/scew.dll

IMPHASH dc673cc809e3fae6159a3903886c9d52
SHA256 cbaaaa7da4d8eea49107009be8c1b63cec951eaeb942f360634c6176dde06e40
MD5 692c01413f439a7ee73d601e48f4e4fd
SHA1 87743f7873ce8e74c994cc2cd8d90ef6f62cc959
SHA512 037772daf3934f20ce3a7a2d93cb7f3d5ef7e3a1686b4b62ce7444fea172e74fcd9bbd94e2ddc7ffb96480b78835e52d6c5645469498e09abbfae62d38911cba
SSDEEP 6144:Kiu1bm4UTuNoo65B8riGD4VhkdGGdaDrd:Kiu1bm4c7b8rvFdGGdaDp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ee:7f:5b:c6:29:00:77:cb:34:23:15:9b:5a:ec:cf:d3:ee:3f:28:e9:a0:e0:f2:c4:9c:41:d0:30:37:3c:2a:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 20, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

1

Major OS version

6

Entry point

104419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\xybspddn\common\scew\scew.pdb

XML_Parse scew_attribute_compare scew_attribute_copy scew_attribute_create scew_attribute_free scew_attribute_name scew_attribute_parent scew_attribute_set_name scew_attribute_set_value scew_attribute_value scew_element_add scew_element_add_attribute scew_element_add_attribute_pair scew_element_add_element scew_element_add_pair scew_element_attribute_by_index scew_element_attribute_by_name scew_element_attribute_count scew_element_attributes scew_element_by_index scew_element_by_name scew_element_children scew_element_compare scew_element_contents scew_element_copy scew_element_count scew_element_create scew_element_delete_all scew_element_delete_all_by_name scew_element_delete_attribute scew_element_delete_attribute_all scew_element_delete_attribute_by_index scew_element_delete_attribute_by_name scew_element_delete_by_index scew_element_delete_by_name scew_element_detach scew_element_free scew_element_free_contents scew_element_list_by_name scew_element_name scew_element_parent scew_element_set_contents scew_element_set_name scew_error_code scew_error_expat_code scew_error_expat_column scew_error_expat_line scew_error_expat_string scew_error_string scew_isempty scew_list_append scew_list_create scew_list_data scew_list_delete scew_list_delete_item scew_list_find scew_list_find_custom scew_list_first scew_list_foreach scew_list_free scew_list_index scew_list_last scew_list_next scew_list_prepend scew_list_previous scew_list_size scew_parser_create scew_parser_expat scew_parser_free scew_parser_ignore_whitespaces scew_parser_load scew_parser_load_stream scew_parser_namespace_create scew_parser_reset scew_parser_set_element_hook scew_parser_set_tree_hook scew_printer_create scew_printer_free scew_printer_print_attribute scew_printer_print_element scew_printer_print_element_attributes scew_printer_print_element_children scew_printer_print_tree scew_printer_set_indentation scew_printer_set_indented scew_printer_set_writer scew_reader_buffer_create scew_reader_close scew_reader_create scew_reader_data scew_reader_end scew_reader_error scew_reader_file_create scew_reader_fp_create scew_reader_free scew_reader_read scew_strcmp scew_strdup scew_strescape scew_strtrim scew_tree_compare scew_tree_copy scew_tree_create scew_tree_free scew_tree_root scew_tree_set_root scew_tree_set_root_element scew_tree_set_xml_encoding scew_tree_set_xml_preamble scew_tree_set_xml_standalone scew_tree_set_xml_version scew_tree_xml_encoding scew_tree_xml_preamble scew_tree_xml_standalone scew_tree_xml_version scew_writer_buffer_create scew_writer_close scew_writer_create scew_writer_data scew_writer_end scew_writer_error scew_writer_file_create scew_writer_fp_create scew_writer_free scew_writer_write

SAVAPI/vdfupd.dll

IMPHASH 7aae4018f59ff65fecb5069da6ba2ecb
SHA256 7b92f32549f873f1849792805cb4bbff2125444383879c244100fd1ca9fd7777
MD5 ed74b5c4230c87ce692df2fbe4c423dc
SHA1 b6a9e2b87d64de18c4c17594954549661fd3900b
SHA512 352458dacf49deaea9f081f50638c898a8044e5fe8c75eed87a5c064d6b04b9eb050f64c7b57d98920192e2bc5bec38096df7554586485140256b230cff97648
SSDEEP 1536:+/L4zK8Oc8MCjx7anrV/pmNI0FFjGULRkTDCouNAotnGp1iP13hIsb:U4z58H70OFFjGULOSAotGSP8sb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a6:31:71:a7:52:6c:e6:c3:28:0b:26:d5:1e:6c:02:fc:95:90:bb:63:cd:43:30:24:d8:4b:de:61:19:9a:b6:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jun 12, 2019

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b4:c6:c9:6d:ab:0e:11:6d:51:c4:cb:9b:d2:15:eb:9c:71:2e:27:45

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jun 12, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

18753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetFilePointer WriteFile CreateFileW CloseHandle GetFileSize ReadFile HeapAlloc HeapFree FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW SetFileAttributesW GetFileAttributesW DeleteFileW MoveFileW GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetProcAddress GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA GetFullPathNameW GetCurrentDirectoryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection RtlUnwind LoadLibraryA GetTimeZoneInformation GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar LCMapStringA LCMapStringW HeapSize GetLocaleInfoA GetDriveTypeA GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA CreateFileA

SAVAPI/xvdfmerge.dll

IMPHASH 7ea29dfb7902eaf1812724d972d2935e
SHA256 ae345a17da1c8923bd89c1cf4322990e5e3b520ff2f0538c01f72f57fecf74a5
MD5 3da205f3e6f1ace3b4f471c3a66f8f20
SHA1 2dadac5b2a727702ad75fd4785d32415f968857d
SHA512 84e31019779c649bf5aaec23a9710ab2b624892efe689a32497c62739b12ba3b78712f5e3a29829be424b558a19bbca0e69b7e78fbc56433fa05a90edda383f8
SSDEEP 6144:cLfwbG31EgrKlbjch35VLFIYid/TGdDZjMlt9wKtgl5jR4wWbKQIMOm9n6DFsIoG:cLfwk1EYKlbUBI5dGdDZ8t+Fl5jR4wWU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

42:8a:b0:da:20:3e:92:84:5c:27:91:8c:69:21:2c:fd:43:0c:f1:12:de:e4:17:5e:05:b5:1f:a6:2e:6f:0d:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

23:55:89:5f:17:59:e9:e3:64:80:26:f4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

146978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\temp\e4jp5i63\common\xvdf_merge\xvdfmerge.pdb

ws2_32

getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept gethostbyname ntohl WSAGetLastError WSACleanup WSAStartup gethostname

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW RaiseException InitializeCriticalSectionAndSpinCount GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetLastError GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile SetFilePointer WriteFile SetFilePointerEx GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW HeapSize SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent GetHandleInformation SetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess FormatMessageA CreateFileA GetVersionExA GetModuleFileNameA LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA RtlUnwind InterlockedFlushSList GetConsoleMode ReadConsoleW ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer GetConsoleCP FindFirstFileExW GetCommandLineA GetProcessHeap GetStringTypeW PeekNamedPipe GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

SOS_README.md

SHA256 72bab8ad57ae20824c84aaf9fe2e0e305b2108286e066545e6bac14ac7af1450
MD5 afdf90f86dd5c98ccee0be65cbb99f0a
SHA1 dd66bbff9bcc51522b0985d0f42b34277fa3ae6d
SHA512 bc06ebe3b83956aa78190b543134d89112bbf33dac89faad71830cf24a872aa1982ded9d03cb38b969727502d26b7b9154781940f0682d5a7c7d330531a137f7
MD5 SHA1 SHA512

NSIS installer

installer

SQLite.Interop.dll

IMPHASH 34df93b01d634fcb6a5390542276120d
SHA256 0dcdfbad2b4fd598ee78682b3920e1a268b03bb47b5dc26fbb9050089368a043
MD5 5810639d1477c0c33ddd1efe75256dbd
SHA1 6a6149730e40fecd9c30534e8f806e310d03e1cd
SHA512 f22368fcf5fe5495d0e318b692f163e8e6438735601132fe0d66158c8ae26e99453e8931388884ecfd998e42de3f98bbc9b10e89ff081609006b9805c1a40d9c
SSDEEP 24576:W4QYrTvFVZfiPaD0Yfvpmy/tabrremrrD5tNdKksOLnvirpl7609abLvN:EYrTAPDYf1mD7KksOGrpFkbzN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

5792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\mistachkin\Documents\checkouts\sqlite\dotnet\bin\2017\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

kernel32

LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx OutputDebugStringA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SetFilePointerEx GetDiskFreeSpaceW WriteFile AreFileApisANSI GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile DeleteFileA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA CompareStringW LCMapStringW GetACP GetTimeZoneInformation FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStdHandle GetFileType GetStringTypeW SetStdHandle DecodePointer GetConsoleCP GetConsoleMode WriteConsoleW

advapi32

CryptDeriveKey CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash

_interop_compileoption_get@4 _interop_compileoption_used@4 _interop_libversion@0 _interop_sourceid@0 _sqlite3_backup_finish_interop@4 _sqlite3_bind_double_interop@12 _sqlite3_bind_int64_interop@12 _sqlite3_bind_parameter_name_interop@12 _sqlite3_blob_close_interop@4 _sqlite3_changes_interop@4 _sqlite3_close_interop@4 _sqlite3_column_database_name16_interop@12 _sqlite3_column_database_name_interop@12 _sqlite3_column_decltype16_interop@12 _sqlite3_column_decltype_interop@12 _sqlite3_column_double_interop@12 _sqlite3_column_int64_interop@12 _sqlite3_column_name16_interop@12 _sqlite3_column_name_interop@12 _sqlite3_column_origin_name16_interop@12 _sqlite3_column_origin_name_interop@12 _sqlite3_column_table_name16_interop@12 _sqlite3_column_table_name_interop@12 _sqlite3_column_text16_interop@12 _sqlite3_column_text_interop@12 _sqlite3_context_collcompare_interop@20 _sqlite3_context_collseq_interop@16 _sqlite3_create_disposable_module_interop@112 _sqlite3_create_function_interop@36 _sqlite3_cursor_rowid_interop@12 _sqlite3_errmsg_interop@8 _sqlite3_finalize_interop@4 _sqlite3_index_column_info_interop@32 _sqlite3_last_insert_rowid_interop@8 _sqlite3_malloc_size_interop@4 _sqlite3_memory_highwater_interop@8 _sqlite3_memory_used_interop@4 _sqlite3_msize_interop@8 _sqlite3_open16_interop@20 _sqlite3_open_interop@20 _sqlite3_prepare16_interop@24 _sqlite3_prepare_interop@24 _sqlite3_reset_interop@4 _sqlite3_result_double_interop@8 _sqlite3_result_int64_interop@8 _sqlite3_table_column_metadata_interop@44 _sqlite3_table_cursor_interop@12 _sqlite3_value_double_interop@8 _sqlite3_value_int64_interop@8 _sqlite3_value_text16_interop@8 _sqlite3_value_text_interop@8 sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_pointer sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_create_window_function sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_drop_modules sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_filename_database sqlite3_filename_journal sqlite3_filename_wal sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_fts3_may_be_corrupt sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_hard_heap_limit64 sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_keyword_check sqlite3_keyword_count sqlite3_keyword_name sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare16_v3 sqlite3_prepare_v2 sqlite3_prepare_v3 sqlite3_preupdate_count sqlite3_preupdate_depth sqlite3_preupdate_hook sqlite3_preupdate_new sqlite3_preupdate_old sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_pointer sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_set_last_insert_rowid sqlite3_sha_init sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_isexplain sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_str_append sqlite3_str_appendall sqlite3_str_appendchar sqlite3_str_appendf sqlite3_str_errcode sqlite3_str_finish sqlite3_str_length sqlite3_str_new sqlite3_str_reset sqlite3_str_value sqlite3_str_vappendf sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_key sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_frombind sqlite3_value_int sqlite3_value_int64 sqlite3_value_nochange sqlite3_value_numeric_type sqlite3_value_pointer sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_collation sqlite3_vtab_config sqlite3_vtab_nochange sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_set_directory16 sqlite3_win32_set_directory8 sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug sqlite3changegroup_add sqlite3changegroup_add_strm sqlite3changegroup_delete sqlite3changegroup_new sqlite3changegroup_output sqlite3changegroup_output_strm sqlite3changeset_apply sqlite3changeset_apply_strm sqlite3changeset_apply_v2 sqlite3changeset_apply_v2_strm sqlite3changeset_concat sqlite3changeset_concat_strm sqlite3changeset_conflict sqlite3changeset_finalize sqlite3changeset_fk_conflicts sqlite3changeset_invert sqlite3changeset_invert_strm sqlite3changeset_new sqlite3changeset_next sqlite3changeset_old sqlite3changeset_op sqlite3changeset_pk sqlite3changeset_start sqlite3changeset_start_strm sqlite3changeset_start_v2 sqlite3changeset_start_v2_strm sqlite3rebaser_configure sqlite3rebaser_create sqlite3rebaser_delete sqlite3rebaser_rebase sqlite3rebaser_rebase_strm sqlite3session_attach sqlite3session_changeset sqlite3session_changeset_strm sqlite3session_config sqlite3session_create sqlite3session_delete sqlite3session_diff sqlite3session_enable sqlite3session_indirect sqlite3session_isempty sqlite3session_patchset sqlite3session_patchset_strm sqlite3session_table_filter

SQLitePCLRaw.batteries_v2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aebb3dbeda2b2eb0605a20acc126b50aca3795b066155292dad3666f730603e0
MD5 0c9ba51b96a446e0fdce3810bf76fa45
SHA1 6defb626766f10eeedae8dcf67c3f9b13be7534e
SHA512 d74fe14562b39f74c4b3d1e1c0db95a77796e209d21006e5af4d82840febbeaf7ce6c2b15cb0622a4250890bb005ece3488190e00344ae2d569917c94e462bca
SSDEEP 48:6kPbdHwQ4Bspt3ya8iRqYcbKNGeztNSClElgiNEpij4iuAO6CDV/ozfLsnOVjf/q:tR9MsziavRqYcfeztNSClElg0nOdVb+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SQLitePCLRaw.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f18a93812cc3c47f6684f6bbaa9b77eb2c8129904e38b9ab69fd3b9b9199b6a
MD5 2b7cdfe3b1e5df87d6a0532e3cd87c6f
SHA1 2c4da12488a1072a5a5eea7d59e759c63db1312f
SHA512 d3aaff1c18d9867bcc4e26d1db3b0f9fdcdf6ccb511740c568dd6ef6b4d42a1bbab67b3af1ea7a0057f9772824951970cc0be4102bfca721cdd2ac270fb9e2f5
SSDEEP 768:cUSFuZ++xE/4pXstBzcMp0R0gNdNib1KgNsVr8EGpP3tOe:cv+wqXstBvKoiVQEHe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

50926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SQLitePCLRaw.nativelibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3210fe35503c5cee094f9c1b86710850dab15deb36ea53c266a9665e4ecb793a
MD5 f7bd7cf71c917b7f05667945775b40e3
SHA1 8140e79d3aee95ad338d292407e5c0acca99d494
SHA512 6dcac6e463264c74370f5b3f2ded397cc3fe198e9a739fd7aae04348e149e205628d1496a71bcf65f6e843a7ff61f7cf60b6c4616e062c4e81c2c5b5c921261d
SSDEEP 48:6fyiWa0CmSUgG6S3mUPIbAO2NlMrpidNtgTHL9hbmD03cDLsnOVo9ryyiii:x9a0fSK6S3ZMAOmUL9dosL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SQLitePCLRaw.provider.dynamic_cdecl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e76fc0da194b3295857ec41586a38900ed0f497f73705496943797b1f367831e
MD5 ec8d22e66b88927334df3019268c2d89
SHA1 2c70725020b60a3b4b244ad7ea404f5416105573
SHA512 24c10111e2ab121e90249624b236952ff7b8c2013c2d21c73adb07f0978154ae3ace82e0f5eb9a0ca55f3d3f8e37938ae20ecb3249a685427b5082593fce6598
SSDEEP 1536:3UZbKdTL9g2M3KuHDSL3kOGYPH/spwzX:3UNKj5LJGYTX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

61790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SSCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5a3605db08a147545f42ed36f1ba54e6766845aafb9c4bac5bb25e11930571a
MD5 2637cf9792004755f9f2c58f77868a55
SHA1 29627ec7e9208b8af39a9a2f90de46575bd4451b
SHA512 f191bf092bb926b15a1a4125632b992c8a32d7273aeb6488b408e35f56f5f1c28f21e74aac495b8d766fc1ecab373c952b7a430a1b0a66290d33cb26ee4776fd
SSDEEP 3072:ZNvKrpCspapTw69UOdDSF21+gNMGhwXf+x:ZhK0sMm69UOdDSF21+gNMGhwE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

45:d3:94:99:be:db:71:e9:11:0a:9d:df:54:64:81:cd:30:89:15:ec:02:f9:ab:1f:bf:4b:86:39:c2:49:8f:14

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

108046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Savapi.Net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fd31a17b2542eb1eff74ed4286ffdce7356ec2972dd92c406e450298b9a27f1c
MD5 719ac767986c8b81cf8ce0854921a416
SHA1 220091f5ec7b06c16f2632af1789fc306f80d87a
SHA512 b869c405975e9ecc8d7320c2b668ceb2b0222d69decbc71526b0f3ca7fb75598e280b0c6765ab3a15fa7b6f22ab56ad1e56ce12a814ab54f264216d207c3ef7c
SSDEEP 1536:1nlusZZboNZvvqAglo4eOwBlAjHy48BQbD8ERi0S3wA:1nluO98+bwzAjS48SbD8ERiVP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

44:eb:59:a7:70:dd:3b:28:2c:da:24:4b:f0:a0:b7:35:b6:15:78:7f:e4:85:68:bd:86:2b:9c:89:b8:da:6c:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

75934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SecurityService.deps.json

SHA256 a05c5d28338d63f92779ac6928d09b3fa5b930d45fd38b1420e424f43306a197
MD5 04b1a64a7355fbb5b5bd3be747870e3f
SHA1 a2e29cc64ebd3e5467ae11a65bd3f71497810cb0
SHA512 8af9c10b64188501432a1cddf2d6377a4d7634a51c5e20be9bbd752571d7e2f1d181c7ff88ac3d0fb017dd0f9735b4b3f6c1b40c5986dbabce3b2c4c31d13d0c
SSDEEP 3072:i/GfgP3el4UUt1YueccmnAH4RMwpRkgTf1yMGtHZqeNosl9SPjfgiHa9P:iIiHO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SecurityService.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5ff3b21fe60c7984c48d51f9d90a7b9dbd962c973af8047f55299283aaaa5070
MD5 8c5189f643c7995f1ae9272f2d9ce14f
SHA1 9e4ce5ebb6fa4cb485e3f211d9cd67bb0d7d31f3
SHA512 06d8e5c7baabaf4882c93b141aa8faa6cbcb734a6a83a1e7d1bb9f02b80c2c44b9f4705f750f8b64a509e814311c61fffd61c61c903c69b54a041895cd87e38e
SSDEEP 768:szYEIku8IN/uHUUdEcdfaz1sCj+tqCmY3EbFIAfkntYcFwYB6KaVVbHhV:fEIg3PdtdG9+kCmY3P/wYBla3bv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c5:23:e6:6b:ad:bb:11:d0:e4:1c:97:7e:aa:e9:71:e3:3e:ba:d6:46:cd:58:bd:f9:0b:16:30:48:86:b4:8e:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

53422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SecurityService.exe

IMPHASH bf1462ce2cfa173883d7ac57d7af7b93
SHA256 39b2ebe538f4cd57a9e3445f44fb581b8302dbd48e67f04924d00732e1fdca44
MD5 f0f2b175528d20d0812c2114a0980438
SHA1 2f6d29ef8c3c24acc6e21a4e90c08639769bf90c
SHA512 262b3f0fd7c01151970511ddd559026f3c905efead91c7cd2f35398bb194a64f48bd14461b8f735b9663254b8ec9a4bee46663e85b9deb4a0b7d49f58d77ac4b
SSDEEP 6144:jCVaAcfAFOFvxVg/vUkXVXXCXXzXXXAXXXUXXXPXXHXXXHXXX3XXXXXXXTXXXIXY:jCYxf6OFvI/ILvBN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

84:f1:f0:6e:cf:be:0b:ff:87:4b:39:26:df:97:b1:a6:26:d1:3a:c2:a6:8f:bd:f7:5f:ae:7c:f5:d5:fc:b8:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

71312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwind RaiseException OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

terminate _controlfp_s _register_thread_local_exe_atexit_callback _errno _c_exit __p___wargv _seh_filter_exe __p___argc _configure_wide_argv _cexit _crt_atexit _exit exit _register_onexit_function _initialize_onexit_table _set_app_type _initterm_e _initterm _get_initial_wide_environment _invalid_parameter_noinfo_noreturn _initialize_wide_environment abort

api-ms-win-crt-heap-l1-1-0

calloc free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode fflush _wfopen __stdio_common_vfwprintf fputws fclose fread fseek fwrite __acrt_iob_func fputwc __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcpy_s memset strcspn wcsncmp _wcsicmp _wcsnicmp wcsnlen _wcsdup

api-ms-win-crt-locale-l1-1-0

__pctype_func setlocale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func localeconv _unlock_locales _lock_locales _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64

SecurityService.runtimeconfig.json

SHA256 dc4b3413e739405445afd837bf5bcfbae96c1172f60f2c397a80b3f7dad8c99e
MD5 fcee6bbea41d26598a182ee769296702
SHA1 694f9ac9bfce76c821bccf8ae3dd0e99be5f6180
SHA512 b2b19ccefd60733b9f13ef1046ca0f825c3603afe6ab376157dc287a06bd8081f9dc067a828db426b7b92038181aa3af6746272330284ecdf80984ec0a38d1f1
MD5 SHA1 SHA512

NSIS installer

installer

SharedDesktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 534e6611f9f424c6567f1f4fae16a28e5e0ab8cd5935b4140a7d0926a60aed78
MD5 8096eddd87bacaf7beafd286b9abada1
SHA1 d9e3cdde0df279cd3cd7af3ff1047694ae81f9be
SHA512 c401e1be4ed19b315faf84e281545cd1d9973e272c1ff56a4786303c07c1f0b7c1f258239684452afd04a4901dca6e2fc946be50949e340626d067a6473fcb92
SSDEEP 3072:W8ujoSb35TXAqDvH3OVPJEyJD1111111111qGqYU4czrK0:WAqDuPJPBq9FF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

33:a3:50:94:4b:ff:99:5c:72:aa:af:c7:10:37:5f:b8:42:24:77:05:9e:e2:dc:8c:e3:be:7e:c7:57:11:d1:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

177422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.AppContext.dll

SHA256 f31a84e23a2927b8f40dd3de13c93f09c6449f72a09118141697533d63d6fa57
MD5 53f19cfe0aa876321a6e869205bab7d8
SHA1 cae4cf9373b99b6bf236456f1de95c0f1a5bce92
SHA512 fbfbea17f8b5298c758e41e2a7fb63d3cb64846069f7e6e7d058a4e1c4b795c47fbda236b22d17e7c048606ae5d7ed93e8bf53d034eb0b71e8571896da92acd6
SSDEEP 192:7drW+FsWUSPdxVC+YZWULwu0Sc2HnhWgN7aQWfFaIzLMmDWqnajKsFukd:VW+FsWZVChzD/HRN77EQmDWlGsFpd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c4:33:33:d6:0f:93:f4:68:5f:00:4d:e2:68:a9:d7:4d:61:71:80:ea:e4:d2:15:5f:8a:10:2f:d0:22:30:a4:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.AppContext.ni.pdb System.AppContext.pdb

System.Buffers.dll

SHA256 d9be9f33f71e0c969bd3b04b18e4ff8989758c0fca93d68acbf15dfd8323a7b1
MD5 281d36c4ba11981b6ac0df7e30fddfcc
SHA1 a71cd7e5950455959e07ac44823f1dbc5acfd2e6
SHA512 d1a3d68d0dc0cf9ad258bf2e508fa5fc79bf2fea671069ce84b6164da2491801ad821f73a999142130f323922cf9d007ec35e14d7fe4da493c39e2979a4bc3b5
SSDEEP 384:ZWYGhWAf6RyLvD/HRN7EPetLwmEy4lGswnyYgu:IznvDv4quy5h
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c6:94:dd:82:2f:36:01:03:20:93:49:e9:60:17:3a:ab:0e:49:b6:2f:e9:99:28:4f:20:86:68:aa:d0:e5:c8:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Buffers.ni.pdb System.Buffers.pdb

System.CodeDom.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d3910d8782594fed0a1542362ac0af0189ccbbe78bb084a75759245b0fbb77bd
MD5 f92060a47c375aa93f21dbc0aa18f908
SHA1 34642be2d85691828482d6b7b78b1f0cb2b387a9
SHA512 fb73612565bb43981a11e12dd89477e5cc70c1392c3948a6d5a44e4d9b3d59fe5ee9723cf21cb7cd121cd7933c347201ba3adf42317c77b3c2dd652f4130350b
SSDEEP 3072:Rcr0PWG/8ybZnOckimh1OoFDiKNpXcMpHIX/eTnUlIbEKYk/qcRt:RsVSoiUyeTnglkfR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

175838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.Concurrent.dll

SHA256 f54e0c9c0b05313942b17b9cf8adda8acfc6e3d1ff012bc3657ed5ff9387ae8a
MD5 06c91e81ac8ccb733458a07c442256b1
SHA1 016d5d5c0ffcb6b1340a118034ff0c1644c7a948
SHA512 30b0606850630e604bb9b44980680837dec3b459280b4195debee7c870b0a09621d876853b0539b861fde851ad6f266b7c21bc73df66d4c0d05554869c74f7f3
SSDEEP 3072:7fUhTsJCh/g90Mhy2NDO2OlCVQrrFaUSBik2zRR4RUKGhRsmPSb3Tec+hZ0MQJ6E:rUhrZYO2wFaUSBilYUA6cAZ02lHf1ML
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a0:3f:77:2d:54:75:cc:51:bc:83:69:36:5a:38:ab:89:07:24:06:93:7e:02:52:d2:f9:b6:12:ee:c0:13:f7:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.Concurrent.ni.pdb System.Collections.Concurrent.pdb

System.Collections.Immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 254d3c34f8398fd50f5deb3880a7198040a22922ef21b5ccce4c1af21d78fd38
MD5 d7d450c99a3bd0f293b53c85fd965538
SHA1 ebeb7e0e3c0a8707085950a0fc97dc17dbf95c15
SHA512 de903c3ea34b68a3c11bcd5b1162b67a820cb04bc7a93fbb4664a88b131eb650b6613acd6f6ae9d9b20518cd2e9ff8a4a405dcfc62eef48f958277464578e158
SSDEEP 3072:MuEBOblJax1oIu4WLuFgoZuptFwVYXu1xmb4Y6yqKcpFcfHlTESAg/qMxTHxQY:Mu5IVu4WqFgoZuptFwVYXgG6p
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

172974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.NonGeneric.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad20889d2aaa9b7a34ea427c9c32af65fb67e2a90dbfbd4114a7482bc331a24a
MD5 fc2a4f176a155533c9e4fa2893cd4260
SHA1 ad439fab50a73f8c1b3e958c0e71c965b195efe1
SHA512 e11e1704f122693417d16d73a4db8464c582924300196a7344c3257a9ddf32ac9322bc4dd7faa0961cbfacdcc0245670dcc2f329f344562c5fce84253a689490
SSDEEP 384:swk8s5hYkV4K9H++aJ4Z98CPYQEW0wXV9R5WqKj02T6acdzkGX2qyaB/nutgNEgV:jQhY+R9HKj/Ytxy4YgNEgVcZ67WoMP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

40494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.Specialized.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 73eeab976c7aaed6da0bb24b14722daed42af2a4259742ba4dc2aeaa94a98849
MD5 69ee9cf6fd5909a0089911fed91e0e2d
SHA1 61c03ec9892681705d3d8f1b8439aaaf8d1acdb4
SHA512 e7e023958b970b76f62822b3c22fb1b57fc1a85602f86eab87e3d626356c64edfd114fb5911739f4ffd5b064537835ab7bbef8df128c9e53f7ba86018de0f8a0
SSDEEP 384:xkg0Ugm2/MzgtSWeJDoycZIDz6KpDCqCBJ2i6c7bsaaBWk9j38x5iCaM7W8xaqKi:qgPtMDyZ95CBJ2POKOs3jPvwu+GDU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.dll

SHA256 5c65193085dd79307b0237c9f0cc249766c23ac1b4996b0f933d93899f010cad
MD5 b0a222d5b765c48eb9569188f2942ae1
SHA1 1e78d3f43c32849fa144341ba9d448a07ff3db95
SHA512 fb3972fb9e96ec984e4137a08cd756d358c0764ddb6a92b189d52035124ee3ecfc10e58470a1675d4f6ce9342f01c4927002bc761d284138f48ffd3b11652ee4
SSDEEP 6144:LtXwIIhqhlyiMZa+lXOd5iS6L0ivTKLbnfsC:OIgi+XOsNTKLb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

19:d4:b3:c1:43:2e:e6:d1:1b:5f:35:2d:29:9e:6b:d3:19:d7:24:38:fc:a5:8a:90:24:28:d1:17:3b:c7:62:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.ni.pdb System.Collections.pdb

System.ComponentModel.Annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1c6875960e4e7673665b8c83a2f96b38eeaa25ca6f50924547f2aa36fffb2a4e
MD5 5bcd63172d34f127d87f3bfa03458065
SHA1 69c806fe0aa687f35eefb4dfff38ca73577b2e47
SHA512 857d12bbba10d92ab5779804dbe4ce46ac5978de90b738c813ac4f9d14c3988ff0aa3b0d3f7a78af1b271cd389937313833bd0f0f191425943482347d55ec21f
SSDEEP 1536:Qjw+8cPT1pQoWfVNvH6JyuZho/kilGwiVBG6QH:1cT1pQfVNvsoX/iVk6+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

75422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.Composition.Registration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d9424f2fefcf665694aea12e2cb7ff7fbc7196049af90caa0e43cbd1563f436
MD5 aff4faf177f73d0e257b544538bddcca
SHA1 268bffd8f5da2603dba26733a9611bb5befd0cc5
SHA512 c70e8144915e39ce020fb47aed98a471178f5639e43cd9075973e520116403af6f6e56bc5ee52646eed879dddc206a6a8faec1a4ae5e39da22c18abcd4e695fd
SSDEEP 768:VtXB8spyLLVCd1vnDb1ZscSLVZ/VYxMCii/9EDvn:V5GsQLarR9kvZk/o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

41646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.Composition.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3d47555080c369692813fcf34e70b01642e4960d3b8048c448ca939a9e1ab30
MD5 f84d96a9698df9c7e48813376c2fc81f
SHA1 7eb3c012e2c53520dfd2086a8a7915ad919c28a8
SHA512 3d73af67e314729ff3d57070fa0af5e7045847aa912d2173a0b156da590358e6b52154c6b7d32f10d1cba56fa8bcdfa68e69d89e15d1b6f25bba16b102c5b8b9
SSDEEP 3072:mjrq86pK+9H9eaeaXXGUsnNjwaFmmgDX/cOoW6xVTIcXbjy1oPv1Cp7CEQtktCsf:mjrF6pK+977nmO56QcXvVHqhptCsayB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

263406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.DataAnnotations.dll

SHA256 a512866cf267827c980495f7d1ba745198d95ad72de3269fdbfe2295af2fecba
MD5 1b97d483d8fd71a9ba6340d795e44c37
SHA1 79bfb8ebb0a75f07497f1d5c31091b1c32390b97
SHA512 bb4f2d7a1d13b71b474f3b4b6f954ce9e333453116fe30cf8bd45b71707d6617de2fcc59b6252e1274effd4a53e8375c281fc9f6064082de32cf2c784f5819dd
SSDEEP 384:CWuhQWHLglJeIeGXxn44qitu1D/HRN7ZX7aJdlGs4O:ghWzaDvx7aJG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

49:8b:87:8e:8c:8f:99:d2:6e:9a:3e:f5:f5:91:cf:c8:f0:98:cd:15:ab:37:52:a0:48:53:43:45:f8:42:9c:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.DataAnnotations.ni.pdb System.ComponentModel.DataAnnotations.pdb

System.ComponentModel.EventBasedAsync.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0554084c1c3c520f586e5aeb6ab1b48afdac42ad9804876f0395e5c2fabaef0c
MD5 7abd490253b8a34b930701a12181217c
SHA1 77bb21890f26bea3e3b3684b75c6cb00288112c9
SHA512 f4a0055b926c9fb98cbd9fbe785356bf498e18fccb3d72a66d9f3c6b20279ea4beb8c35989208dec08dafa21deec90643233502d5e0eb3597232c29b0c092a52
SSDEEP 384:eBymWyiIAYmu2ZUQ5JRD5dN8+RbZ4jJwVuugzkFWv8nW:eE3u8UkTNzOftg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

19790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ed0d14d9239978c91e0db229f7eef649dcae011433ad617e4fa165156b3d04d7
MD5 377bdbb5365e3884163ab5eefacd1b24
SHA1 96cce9a221b1b10424e0706e05e266f08c8c542a
SHA512 896bf631be15e8907c267dd00807ddc0a98dfa517f4effda691a9cafffd49143b0eafa54cc18d449b9b1dfecea84eacec31806c9523a36521c82fc9512d14f9e
SSDEEP 384:4wA+OR5hINt75/v+8Di4LfxwoEr0nR1C1ipB5w96qWnfOW:4w2R/et7k8mHoEQiQnj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

26878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.TypeConverter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0f9c4e8f359fe22ceed3d5d2b02b5111c21cbc6affaa5f13bc99a473f55d6324
MD5 646bf9673cc33013a545d0e5ce4976e0
SHA1 2ed3e527242b1e21a228a4fba420a9961f0ec03a
SHA512 7e7466883695cf053e5602d7dcd7555cca15d4393d365dad65e83e5a4ff69eea15c0fa1ff92ed206d1aa92764805b76428f9e12da37ea660c1627a8c0114dc54
SSDEEP 6144:fBxLwZHK1PcEwy8bSAmcxKOTeNcB00hxVjrr0cC:4RIbwy8bnwNcBhP5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

264334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 25672a381f26126629cafccd98aff16b64d421108e8c532e511406451c78b8e8
MD5 911901cbdd166340ae528b225ca84ca3
SHA1 a09e275eeaa25040c4004892b663799d7e0d761e
SHA512 8acdf80645f9f51da4fa36339d5d50dc8157dc7ec2e580ae4f6055377da5914a8b939cd133c7f7b6313ce44e7d8e73ec21cdd6a63b0da66b2a1de08b238b199c
SSDEEP 48:6+Fo6KQ+TuoY3LlciVcdDf3D+O8gO++IvYSvftDzDseDSPyWFZWOTW0KhW3aWE53:Bo6KQ+XKFV8+AZxvYSv1DzDOpW4byW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.ConfigurationManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d9629ced6b319b38524a7058e66a0f190452d1a24dc615fd66f8c4317c9ad894
MD5 5294941977402f5a9f85d3075feb5870
SHA1 84a98acbfe206f02e04035bd2df17cbcb629af20
SHA512 4721307125dd61cdcd6a56b490596d2ee0a0f117abf477be6926a0124544d3d5147fc6c10d9ccb33bb41a3676374fd3ecb3b0b4098359715c2dacb59f2cc1f8b
SSDEEP 6144:hn1wmsacaTpNltGDafOsdV0Z8oApKK1sPTdokGH5OTNWLOdqJJQN9NtxwP9SGcio:d7staTpNjG+fOsdV0Z8oApKK1sPTdokr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

370974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.Install.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5db83e7b9457f3a6b035e3f5e068ed9b987fb133afa97fdc52b721a456bc4b1b
MD5 ff8ed1c6d4fc96f5977d24d44acfeac2
SHA1 a42918e3ab24fc77bf79b1020fde92bc775e6688
SHA512 ef3a8b36e60bfadaf1a8fe41fd5247b9aef5ebf616d54217ca30331721ddc4988e5afcf172aa7b8991804eb75abc6084e301faeaa52cc34dc7ad2de7d7f2099f
SSDEEP 1536:be1Ts5I5uw67PlTxRtKg/E11Ymm5l03Igs:weI5mJUg/oYl0ts
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

63758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.dll

SHA256 fa958185f19e4b4223b40121b170e3431fcbc1dca4570207f053e17f1ed00e52
MD5 5e94bad43f56709f6feb0c9e5ea2a407
SHA1 4beef9db309980e2f6f1193f1e101bca220ed666
SHA512 c8ebf111c2c9dfd61dbb545284441dcd84cb689114b8ebc9b88a2fc8a6912da183ea8de8a66b9db43f162c379d2420765eed59ca8b7f2765d247453edf1d0533
SSDEEP 384:bWvD6W6TXTSv/fTNRvGZYdf3zyP/weDgdJei2MWuXD/HRN7f3SlGsh:chQkdrEcDvff
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:e1:5b:3c:3f:b9:4d:3d:29:90:31:a4:e4:fc:e9:06:02:a5:1f:f7:66:d1:7c:b7:34:41:fa:1e:cb:d0:8c:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.ni.pdb System.Configuration.pdb

System.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad06ea60242d531f3e503ffb6135aa3608ccc32a8a12ec0fabdae4018c0dc75c
MD5 7dc1732dcbf1e850e9e9118f84b9abee
SHA1 5895132d84a0b0591fc9f7f3b10952dc8face187
SHA512 9f026fd08615a5b687afa7cf434df30530536ff0afaee33de1b333af2f8921c4a351487bde15094761d3484e47deadca0ff2cf6ce7deb666ff390acf4196ed17
SSDEEP 1536:+/kkuqo2U8bQES7zVSfdrtq2CF0sB8Ake3:DrqtU8b1S7zwlBLCnBpl3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Core.dll

SHA256 9da5c82f35c5e0b96e339ae85f29e5b5866dfc4584ea36e220aa5b739685c039
MD5 e080ec9ab5d14a4b3bcdc24ca2969baa
SHA1 5db0287b13680f93c7ead8194f9a0e5a0df62d1c
SHA512 38f8b3629cdb828a63953569681992e5aab005d50972f8d60005915c98bab1d97a248708dd6b9710069454e2ed88dc90e9483723935f2188f11622008935cb75
SSDEEP 384:aWXGhWVxkVVOU1CXtlB7ksmopBFXLwJjd0uQRz2+gqXPRRD135LOXbnqut5D/HRu:iC/bB7ksmopBFXLwJjd0uQRz2+gqXPRn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

02:ec:73:5a:2d:7a:65:31:11:bc:5c:3c:80:e3:74:4c:81:be:66:e4:75:e4:20:13:75:09:d5:09:c9:8d:4d:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Core.ni.pdb System.Core.pdb

System.Data.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 342e5e57dc6bcb5dc0f41e68b6af8671d7687efe724be3678e07ba3785c9eded
MD5 ffb2ffbdec674a239bba1660b2a545cb
SHA1 1b6923ad42164236cb44ee84849eab06fafee078
SHA512 ea21f49e9dec308853537d5ae53ad6118329b75d7a25434a6167fbe5fc8b122d5cd17e440f093966dcc26c839ae2df77e9ef332775b9148cb77c28cf7e1fd480
SSDEEP 12288:TYmCxNCYK16zj4t6qsGjGvMaQ0aW3miUgnKq4MCBubAlXnIRNV:MpfCYssGGMDW3mifKq4vBPXnIRNV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

959790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.DataSetExtensions.dll

SHA256 8114d3c31bd517df4888519cd95401e86b5f69b0b2d7f2939bec54d97a185d47
MD5 54b635bf63fa9e18fc5fe79d58d1843e
SHA1 5e6c2013d2e4c03740791d86afa77ef8236a0d4d
SHA512 01d8072e8c9fda0df96724ab9c6651049969a6eb06d7a7a096228fb83fde5ac3aba333706459c44c45081aebdf99b4689117e287615d8a87d27529ac2eead4f2
SSDEEP 192:NAhPWalsWPIV/xkjb1O+/HWULwu0Sc2HnhWgN7aQWjjH8ws4ptDqnajKsyBZV:NARWalsWckIAVD/HRN7qH8ws4lGsyr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8a:89:24:d2:6f:fb:a3:b7:e4:42:9b:52:67:4a:16:3d:40:ed:17:4e:7f:42:97:2d:8e:67:b4:cd:87:41:e7:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.DataSetExtensions.ni.pdb System.Data.DataSetExtensions.pdb

System.Data.Odbc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e4ed82f8cff2b194c223b7cae7dd67a54f433fa27e895ec216c57576659ca7cc
MD5 17219622e80e5992fd7f44efc3fc0ef2
SHA1 3902c70670f0bbdb6fc58c7dc84cf92d9ea47e31
SHA512 62defd5445bb88705bb8af9b5ca3e920af0472b075f1f5cc05b564e2010e3d185b54528cf16f5f3b198a5b712cdcb969314915be032ed0040c3424cc3a0cb294
SSDEEP 3072:qYoi4nfyAqFhVsTvhN4AtfAS7bCXEi/aMeNOhw6F0NYfpfNs1ObOF/Ai6u80/tL:aqAqFhyNn/CUijwZN+f+1XF/Aiz8M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

256270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.OleDb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a15177a3f3ebebf01b6fd59d632e8aade87e8413a9c9dd7fc791706a2f14ca85
MD5 db5c7d78e7013dd8e3d516dd2426b3a7
SHA1 0c0f7db20c7ff206cca8767876ac738409e0a344
SHA512 6684a078a3410e8f83244874062423149b2fa62016c74169b4bf2f86d19e19ea542e6453f4accac3a6d9870f1e53cdf95e1b58792f16cd6893a9e877eb7676c0
SSDEEP 6144:ovZNPlrF7urbtYC/HL4QJHVqDvVIlKcVrmj3y1UYcF:mNPlhtC/HcWV8IRr+yy/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

351278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.SQLite.EF6.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6d76c1b7aaa70c319d5802505214ec734ecbaed9f8e9776168e25ff0808c4185
MD5 4f428be996d234e1e66b4651d5850f8b
SHA1 4444f6b6e5fc3b117abfbc097358932a72986532
SHA512 302ef1ebc733d716150470a37c21fc8037b0ce2404a98d73b94c84f0c015e69a1c3249d887605ce577671c20d6c5011be6e3d5510a774dc46f2e214115fa5491
SSDEEP 3072:AruAaoTvRdmltzgAHVwIn6KP8sPBsq+4uZ4AIa2r:AruAaoT3mlhDVwA6KP8s2q+1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

189870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27869ae8706d91d81e29b669e8140abd8b6bcd0c8df18e70fcc7d6ecec9469e6
MD5 3a3dc6f0ff7b9d8311b62243f45119f1
SHA1 13ad0df5d3914bf4529cbe424275cfdefcf16aec
SHA512 031c7ec34f07499f94cea63b09dc53cb3515a139cc60c0544c76be8fd6f9211f53a7daf927b5d1487abbdf945ac51ecd8e8d82b48a706c6a21173276d6b45c0a
SSDEEP 6144:vA3IUiJWeZ4idh2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5i:43IV6FNFaFeFOFwcGF6cmFWc0FWc8cIO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

358926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.SqlClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d80f86053df518465cb37282e27a5f9d5744e377b73c1256acc32870ec7c8932
MD5 a96f1c6e55ca098dbeb17a33ed36d14e
SHA1 bba5bebc977bf0c79a1a16c561f1e7d81aa9bc2a
SHA512 6dd16ee70bc785b88c6fb80956275979cf69cabe6270558ca7d223f8b2fa33dbba633c57cc0f09ed8a05d7fc0281056046be9264cda3fe1edd8198839c59d5d0
SSDEEP 12288:SI9KWOF/4G3Hd2tiy0FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFHFtFVFn:R9KZsteCBadSZLDW7iPu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1017118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.dll

SHA256 26a9584343db5ae06bcb108e03986fda3f79929cbc4805d2cfc0303deed60d83
MD5 3e1aec0821b1c851790241051a505a82
SHA1 cffaf0a8d237d4aac32c362035da2a83d3eec8b3
SHA512 eff48af777e22c3c40c710cd8a4e9b25c6116437990e3d181e58811f55dba126d2b11a2d93f509f0c201a071a570733dd8bace5868a3c59aff317db05e8a08af
SSDEEP 384:TWi7CW1m1j2Sux4ZQodPcq59oFJVEXEaD/HRN79EUSlGshFr:VpmC4ZQoBnUaDv3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cd:70:2a:3d:3d:fb:50:47:26:ec:87:50:a3:c4:64:f3:fd:c4:3e:91:57:c3:57:e5:6b:32:08:f6:52:b1:1d:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.ni.pdb System.Data.pdb

System.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f0225bde7a7366a95f1cbfa4fdc5b443fef8b01e67e2e8c5106ec921bffab0c7
MD5 c323d25f0ecce085cf7909282e05ac12
SHA1 8e674e23bdea1f1eeccb4d9bb77a039faf7aa056
SHA512 9c9116ea07b7270b0d217e6b1ec8e50a64cd4830efbe2da223da00c72b9d7019d6684ab9e1ad1c515039eec8a9238ddde39f82e8733c978671f05bba75d8aa95
SSDEEP 192:WO4/UFga/GtLbrc7/ciqteUCiGA+yQaxiSWWHW:Wv/UFH/iLbrw/ci8CiGA+zAiSWWHW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Contracts.dll

SHA256 66aaab3e5466f3fd711db54ef7bfed2ffa2290d32a0d799e00a852788adcb5ff
MD5 bf3d14d575b82de2ad777979ad9e644a
SHA1 13748a8f184b95ba28c2eda2df3f52172e8fe2c5
SHA512 caa5854c4fed959fdbb8d5cb4d2b89d910a717554102423d0826070bb0e3b86dc403d89be625395d7fd8a1caba9074c066f02ef292ebfb923f61470f4cedb062
SSDEEP 192:YPW6GhWPcAkZxt+6AWULwu0Sc2HnhWgN7acWbBZL1aqnajKsh+z6:KW6GhWEdDt5eD/HRN7YBSlGsh5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4a:ba:14:e6:60:d9:fc:38:10:d6:6e:53:9e:be:d1:c5:b8:fd:df:72:2e:c7:89:eb:9a:16:ec:02:cd:60:63:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Contracts.ni.pdb System.Diagnostics.Contracts.pdb

System.Diagnostics.Debug.dll

SHA256 2f3ac24a42de91ca3c160bce28b2457ff4c8c0f5f927f1b32a6703877216ae5f
MD5 998c8af6a444bb39ff92051a16b0cd53
SHA1 55ce3587e5cffcc2284cc22b59b05adb04fb5da8
SHA512 66aa21809ca4f9c591214a5e0752ca853475657adacdd9716482541184c5c0c39a6cf34d27676986b0bc90af50b3a14cc1758b2ec3c4a92fd8128792daafe1d1
SSDEEP 192:JjW22RWJSBdMDx5+WRh9WULwu0Sc2HnhWgN7aQWg4a+LhMzqnajKsIhB1mO:1W22RWwBdMd5RhHD/HRN7WVslGsIz1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

88:d9:4b:61:8b:63:fe:7f:20:ce:32:a2:d2:57:62:56:72:40:f3:6e:1c:d4:2a:6e:7d:b7:9f:f3:1c:ae:c6:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Debug.ni.pdb System.Diagnostics.Debug.pdb

System.Diagnostics.DiagnosticSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 996ed83d6ad4d366957ac9d81d0778f6dd536160bb52e6767abfbf61fe5a7069
MD5 c6fa0d0d71cb8c927ecb086649592c2e
SHA1 bcaf736325f8f8b0ece4d3b8a96cab2dd21ce893
SHA512 da482c9ecb574a140761ec48e4a9bb8868d94ae2a0db56f746b91ba6848ce46cb039be4c6db5614c24ec4fdd09c53593c072eae15ddcad9932113f107c8ee841
SSDEEP 384:rdQ79vkYm7EQz96oVsqM3ZN+MCQbzld1UmJstQfc058SpZzb5TtYQFtJTG/hULW0:Mcc3NqMpBtzVJstQbmoZv5pJtWp+Jtb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.EventLog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3e585a43846e5817c72a48778759232e2e9328af4bc6ad7f04804a11f3918a19
MD5 d975f4a3de1da0f9f44e44fefddcef83
SHA1 f2f9d4bc23c7d49832f49b5d080e6758a2bcd0bb
SHA512 819596d1438a7ce211470555f36e254e9752864170aed6535605afe148511527f339b9f900962f98a70219ca71e130e48cd9c743a9c0dc20a8b0e26a602986da
SSDEEP 3072:vmG55WbsGpZbUBjlEkmsmWOSupk7xkbZo:+GLWbsEZbUJGuOSy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

125022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.FileVersionInfo.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6abd6c09bde37cd301f85296897feb4da1ebe0445968035206f1ce3c172daeeb
MD5 5a0e89338c8efe2874c47066650f4f8a
SHA1 a7255307ef791e692ff60b569b176d1e85b9ca7a
SHA512 f4f1035a32306e80b7058dec723ee8718c3a0ca7195d52082df57d6ba00287c7101ba39a5bc22c773a43dc678884713fed4fc65b775b9aaf936471392ea84a38
SSDEEP 192:xY7E5VhLH10l7c1bRSjB2biWqehQN9NZFdA1GZnJxB+RxeFrtWkrWdBVqW:lj5g7cE2iWq5Fq1G7xcXqWdBVqW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.PerformanceCounter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3fca48b76b759e33cc2cedd79ab4a84c2ee9c510406226a8dbdd09c2261afaf
MD5 52d9706fad7d6e73229d082499573d7b
SHA1 c4de6048eb26c913f91984a58667130dca4469e9
SHA512 de2b40afcb02baa601aa089501db33d90489d617fbe0b20364a3f157ec8dd6ba5506601abb92b7610443026b9588d127eb166ef2ba0f2efbbc4a9b1ee6d6df03
SSDEEP 3072:qSVBqd9rzX3B2asiZaObvkeaSlbAp/7cfR:xBqPsQnbvwobiY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

120350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Process.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f8ac5faad99867b8f4729f2f8dd03a0d7f335c931e1ab7bb2b25813bf7a24530
MD5 13b563b7421705d851e8ba4adedcde7b
SHA1 2752dc7b85d6496e44dfd22bc5f67b64ca3fed8c
SHA512 e0dffdb1f9a3bdafe2a018c391aa0f8c1fd8f93e9864c7afc8401ba531a589513d90b855e69ae1126fd1e5974713dc8ebed503871783fe7a708baafa5100b954
SSDEEP 3072:xHHfPYWLrjvSTm+joq+SfIy3z9z9b3771PtqKg3S:9BHkfJ9b3771PIN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

110926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.StackTrace.dll

SHA256 c5abe351f31fc59715d93593bcd99be77b74adf63a9a2e23ea2db41011824409
MD5 ac2e4694249650dc3f137314e028e238
SHA1 20f4bb47e9a5d595df92a9f33ad19d52b3a39f2e
SHA512 4bbcdf110855791aa339075d882b0f3129977862b7065320ebb546be9e0f64940c154c3687ed4fc5f59399703aa42a47c45b21829cf05048884fb89f708a31bc
SSDEEP 384:JWnsXW5DF+r8swou8gImt/RLnrtzt+QcCmVwA7fQX0lemt75M7hX3J4jdD/HRN7V:RUF+r8slu8kXZwQc9tm4t7WHajdDvc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

29:86:7f:30:dc:f7:10:64:72:ea:cd:41:c9:ce:26:f5:ed:52:0e:26:f3:9f:31:96:e4:f5:04:b3:5b:49:25:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.StackTrace.ni.pdb System.Diagnostics.StackTrace.pdb

System.Diagnostics.TextWriterTraceListener.dll

SHA256 7010cb1d032a890417077724b07eed9e9a84c679122cc4e321d727372c0de4f7
MD5 7649ac413c3c85863fc54e77fbe7e996
SHA1 a3c89ec166f17b167650130c7d6edcc363e09880
SHA512 3b796ff231028eaf20c1645b43d9e16346d9edb57217e75d85830b435625824f660178d749676ad970204f41c0da8aeb5c2b9847b16c631e90edafa79f8cf672
SSDEEP 768:52Q8MVdRTBbJeq2ZqOklRyNbv3pgPYVjADvL5:52idlBbJn2ZqOkl8bq2OvF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b2:94:4f:bc:97:35:e8:71:37:79:04:8c:13:14:1c:de:b2:12:8b:aa:f2:9b:02:c5:34:aa:4b:62:dc:f9:91:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.TextWriterTraceListener.ni.pdb System.Diagnostics.TextWriterTraceListener.pdb

System.Diagnostics.Tools.dll

SHA256 2597a1e42f64ca9d85d0e59c4b7feb042265512ba15297c1dfed4802540cb0c2
MD5 9ac336817f83419cde7c9737e3e9c5c4
SHA1 ef73ef469ec49239c88eafdd042d981882b6519c
SHA512 8d5209704f6985a4290b04f88fffdb231eb853e0155d3455de18994b848f604c0f5b8a1f389b51b5fa6df485585aed66b4317621f0328604daf750d4120f084b
SSDEEP 384:fWQgDWfALOh4M0nD/HRN7RwH24rlGsYae:c5i50nDvRE6Ae
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1d:8c:24:43:6e:17:0b:8e:da:7e:a0:1c:2b:cc:b4:62:5f:91:36:67:bc:a8:0a:29:11:3f:32:e4:3d:f6:59:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Tools.ni.pdb System.Diagnostics.Tools.pdb

System.Diagnostics.TraceSource.dll

SHA256 d807cef17a82a131a6931c5b83e8f6639b4f12debc2d499bab1b5e81221b937a
MD5 0ed5292a1da933920e8498d25f5d5126
SHA1 bb1408eb429ce0406b3732402dc6cf1f52628dce
SHA512 2b15089821ccca9c891c22277afb7d4e1de2a29202f33cbb1880af39b3c74cd0d0f7e8d631859965a5dc519bd7b84e9ab76806c28aa09edf3877b64040f88e85
SSDEEP 1536:0Mg9Fs/6PNmJElBQO8L+gEPEQq3zvlhBco54syFu2U2E/AOKuauaaK0ckr8pySoR:0Mos/6PNmal3ub/3ckrwc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

34:ae:92:52:10:8a:bc:b3:93:7b:f8:0e:31:a9:20:d4:63:54:64:5a:3d:85:e0:9f:49:3b:10:7f:42:92:dc:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.TraceSource.ni.pdb System.Diagnostics.TraceSource.pdb

System.Diagnostics.Tracing.dll

SHA256 584acd899c7805ad3819745a6710f2734ca73697e867ff603a33d9804456d139
MD5 32f2ad5e565765d257e62e407a278046
SHA1 7dcec6db5c65f4e5a7cea867926a30c6719cb0d0
SHA512 341218c87fe0229d8092f9488a66c1a0704e5f68bde7eed9027e292bbe8213fe2d9e3bd415b946f0be47f2c7ddfa1a35f35a11ccce00121a68e9f222698a12bc
SSDEEP 384:eWbdEWi+ysGUs6FUEVD/HRN7QqJ/AlGsuCb:RBGUsGdVDvQK/x6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e0:91:6f:b4:a6:1a:f8:e6:49:3e:7f:58:fd:ec:34:2c:f6:76:e6:01:5d:28:0e:a0:75:15:39:3d:d2:3f:ac:6d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Tracing.ni.pdb System.Diagnostics.Tracing.pdb

System.DirectoryServices.AccountManagement.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3492d44d9fb05b07c0c7302b85dab9dffbe522085ded93ff8868ed6bf5e162f6
MD5 cbd45c5b94ff14408bc443e7b95181eb
SHA1 6e06d9ee36f29adb10a6b12f1425454a48956f96
SHA512 0f9edd0436adfb3ed3b4f4a835751395dc76cd1f220b415d76e99255f40c2ae053c07e3e90b330a46ca7e3161b101a9d6bb92b85efac8782e2a334b4ca9ae2af
SSDEEP 3072:db3kNZ2FXU2URLoegkGLKu1FjRr+MpjzzZOQIjNE7wS8Ww8jwN2klRZ2cT8z1N7y:KNmq3GL/RIgLw4wNPfZLEN7RkkWd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

270494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.DirectoryServices.Protocols.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5705a01705fcd05fab4fa91d3fe35338898cf6bda8375dd6e172dc8d84969648
MD5 3e30539f7b5718887d8886433cdedf6b
SHA1 5b84bdeb9f807d150ead048bba680fc511693b3e
SHA512 74269c9e22705c0fe14b3f6994b63a3f1404d66980ee5721ace10c0a4b301cdf615be8e537a4cf03702a1e03951f10264562aadac0891ff31e477d62fc781657
SSDEEP 1536:oKvEDLCIyyxV9rCF4Da48YLpOTwaUrHZ8ujD4nX5IW7keDfIV9sCgY+YQ:GmIyyxVI6npHL3IIW7keDfIVHgY+R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

122654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.DirectoryServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d176f4579c03fdf4660353153b20e2063f348b6becb9b073449cc5c1ec5ae745
MD5 e61418e77cf4b0b77ab3d808efb73548
SHA1 94e6bdea7f1c4317f721b611169d9ccf6c239699
SHA512 76c02a5efbd26d63e049e5d1cd077de74dbc06eb19d39d997089dbc3c0478e00a13548f1e38121b9e4aaa55ee987bbc27607f8f8042ef7b0b04cadb0caca1d89
SSDEEP 6144:RjhaX6w8sb/fgViR6RX89IhrIXalKupWE97SDN2qavbbUPlMYaf:7aX6w8sbEa6O9MIKQc97SDNzal
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

358542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14fd0e9f1661efd9d42eb7c84dc0c8d159258fd05f0344dca29e73d301875b98
MD5 57a487ef0fc7674d58061a3ce37782e1
SHA1 d8b52db87f4fa5895480425b2f9017093b3a267d
SHA512 06bb517491e8abce98bc635d75da494bb8977e2d972eea474a4661ce84407102e27cf9e1118d34dedc3124be9d97f9901c5cf8835ff6ec79c4cf7dfa240c87b6
SSDEEP 6144:Znp7x0FMLCzziq9rdr/4lbPvxsPdBmBvhqqW931:ZBCMuz9YZHx4BUy31
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

409454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 97fe56add7adfabc7bfae80bd178952bfed3fd2682fab6bedd28a57297f22831
MD5 fb9914429c3aa536be14f16d94dda8d2
SHA1 8c46134acf761c01805f5c405087a02e979c686e
SHA512 a33a24ff62371d6de767fd8f4a397f0b81c5d71a01b0492c60f907a2a01ddbdcd38639ae96ac7696f6b6b75af35d4a750f9ed2914fef843727570a0b1a63a9a6
SSDEEP 48:6bZtI1Lyw59vXwlZMJ7suoMeU+IvBD/DgzWZiEDXZWOq8hlbT5WDXp9:CA1zXQW7su1xvBD/DgzYfWeBW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 160e7b16fad3c25f5f9ce14400fc6ea2e751cf94891a28cbe0f1520c91bcd795
MD5 7e6c38de642d4efa81e557a5a84bb2a4
SHA1 7b3a790c31096149b2f53294d8318e1e27155fec
SHA512 e9acbac993eb32ecced04e1e9ed94c68211a056ad42e3f1ad1c58f4d9a1edda4b3a160e8beefb34084b9e66405ea47f60bd56bb06eea2ec6fe2dcfd2febf07e8
SSDEEP 768:25RbmqzJjVi6diWO4w8BWNSjo9puuBcAOUF83Oew9MyT5jBrnF7a33W9AI+S8:25Rbh6k4/NVpuu+jPPw9T5j9+S8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

53198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e4df2247eeb08ca8099ff7fca25b304df6afe69fe2e4ff020d1cc3c6e54135c1
MD5 9d4780a9d3c2d285a027298b17990ca1
SHA1 a0097a82b29a2146f861b2418126364accd1bd50
SHA512 1f5b716fbcd020c7566fc727ac4c9e363d553b955f4f45e409caf3f6b35cfd612b0d856c63fcd9aac653789de8058a90bdebcb6d2a1e2733b31a5faa1cec5e67
SSDEEP 192:nvI9nPOqgcm+3GbNLe7VYrYxrgjsC/DVCx9r9bWTtW:gxPOqgcF3Gde7VYrYOjT/JI9JbWTtW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Dynamic.Runtime.dll

SHA256 f9908c8a0c66bd7272d7d381707a19e7dcd90b75e5c60e941e3df9d58e0c2925
MD5 1e90cc6de44776206fb72453cd94b725
SHA1 0c9b570eaa7869e835fce6be680d224143f55aae
SHA512 52127dfaf0b438d0ab842cebdcc2d801cdc3dccecde9dcf91bb920535bb46f84970da86a2376bedb1116f623b5cfa577798e3eeb7a23e35138e8e234ecd0fc3c
SSDEEP 192:/ab4MWsC1WEogpxBArx++pU0WULwu0Sc2HnhWgN7acWwcjKGBs4ptDqnajKsymhP:tMWsC1Ws7BAl+FSD/HRN7W/Bs4lGsyod
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

62:0d:99:72:7a:28:3f:19:81:e7:9b:37:05:cc:fd:56:ee:46:2f:3a:cb:85:32:a6:ac:74:bd:5a:3e:93:42:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Dynamic.Runtime.ni.pdb System.Dynamic.Runtime.pdb

System.Globalization.Calendars.dll

SHA256 1c31ecd6f73a13f4f562504ecf866f88b74fe7cb1bf1e97eefec045157170f80
MD5 8008f5c9970bd87e94d28d46be7e0725
SHA1 b228e240ecebb0cc224635f8f2c98af8b7bd1c98
SHA512 0de0296e3165e6ce787478c0c851c3b8438fddf26db9500616e23fdea07d1926edd0b770c26e0f6acb304aab6110b72f13586fbde7395ed175318b4fbde3e7ed
SSDEEP 384:8RqXWDRq4TRqm0RqsWUuuEfnoD/HRN7rijlGsn:2qKq+qmuqjHoDvr3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f2:84:bf:fd:89:0f:7a:0f:85:12:1e:76:cb:02:bc:70:8f:c6:a1:6d:91:d0:f2:28:c2:30:19:ea:21:65:fb:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Globalization.Calendars.ni.pdb System.Globalization.Calendars.pdb

System.Globalization.Extensions.dll

SHA256 c9445006a83534a6b22f9d008830fb50cae11fdbb27cee851a7957712e39c9e4
MD5 5b41420f77ef42f946fc4c5ecd2947fb
SHA1 31dba86494525991795173838db078d130739ede
SHA512 4dd1b6e77fc96c995dea7dd356ea4cbc660b055904a133813624f180a5cc986c99f49bd1978ed0d452c6c6560300549f7de850080672c1d48a30a7f5ac32ff6e
SSDEEP 384:aRPWYRggRp0RkWrA46MmD/HRN7lks4lGsyLU:INZpudA8mDvlR5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

68:b5:b7:ed:24:9e:7a:20:bf:65:8a:ed:3c:ea:27:41:cf:42:06:58:30:53:9a:d5:d4:b9:0e:bc:5c:57:b1:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Globalization.Extensions.ni.pdb System.Globalization.Extensions.pdb

System.Globalization.dll

SHA256 27156c06237f17f50d7fb285f1013471cb7e19d9df8ef943222241fc31ca53d6
MD5 4c2e551914b22c3ddb8bee1c2bb6a666
SHA1 36bda598c17a48d56ce447125092bccbbc8a0b1f
SHA512 a76647a7e73d635401513fabfa81d6af538fab0602fa3cd4ce2d78b8b4d40e001b623453137d2e8914bec8b44dbaeb989a8747fa6bf5982f231774dd83e50b6d
SSDEEP 384:FRLWdRMNRA0RAWufZ2wD/HRN7uqFJ/AlGsuCX:D04Ausf4wDv7j/xi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

85:17:58:8f:2b:27:f6:9b:04:82:78:fb:05:c4:1c:ad:2b:02:e2:a2:2e:98:09:56:22:53:3b:fa:3b:7e:e2:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Globalization.ni.pdb System.Globalization.pdb

System.IO.Compression.Brotli.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3aa6dc03dc737cc15e1ce2c7fc9b79182a15fe95bfbfbecb6c16e1df934ccaf8
MD5 76449fa3169d752724897f414b413527
SHA1 77535c923855c3335ad337b5c092b46eed12ee12
SHA512 bef0d7081f2edf101765f7f14b6ab8c111f02a1fc1c935249c7d6fa91d1fa2a29dad2d977e3b90bbcd15b5d7f1fe38de017f09b9888fa4317e6516a7b441881e
SSDEEP 768:9OCKEExaQEWggXySafMbvlL0op7vRRabAaREX2YzH:9OCKYTWhySafMDlL0op73abRcfzH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Compression.FileSystem.dll

SHA256 31ca6d7e905413618d4b3a3372f2e786bd67ea6ab71de21beac1aa2f28ed58b2
MD5 f30d34a221f53e0433192125a9dd4241
SHA1 b8c36d291915c730bd639470e4a8569ade663801
SHA512 77d4538f1e42c3eccd5d353236e5db9af8cc7284878ede30496aad459c183ccec83e2a732c24e3f031d8fac9a772577b4fd77f882a2a134b4397571181bb0579
SSDEEP 192:3LWumRWVYlU+F+TWULwu0Sc2HnhWgN7aQWrlqoj21EhqnajKs5Topw:bWumRWuW/RD/HRN7MqslGs5Top
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d2:3e:66:fd:a7:c2:b6:be:04:12:4a:89:2e:b2:13:3f:c7:8c:14:5f:ba:55:90:ef:dc:06:16:50:fe:f8:da:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Compression.FileSystem.ni.pdb System.IO.Compression.FileSystem.pdb

System.IO.Compression.ZipFile.dll

SHA256 c3f07ad8bebf8aa5ae873d5cdcab105e738394088c62ff564eab440a9541ef63
MD5 0682eeefc61433c586daccaec3e44722
SHA1 208dbc63a97eb7f2ac714cdbff403dc2f23c8721
SHA512 e61ba117d6a1daa05cf1d3c83c53b682d0168bc486d368bc6ec21ce5079938cc058de307a80ea6dd202aba459cc146c18fae6e1f6de567f1cd805da366c5c38c
SSDEEP 768:zpFuK2wuCRWMkRIWZF4scL/ftDqfwDvV/x5:zvuOnc6vV/x
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

46:7e:90:82:cc:70:5b:ca:3e:72:df:3c:20:bd:8e:0e:21:a9:a2:d7:ea:9b:9c:eb:f5:6e:d8:f8:07:08:1e:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Compression.ZipFile.ni.pdb System.IO.Compression.ZipFile.pdb

System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2273365bd1207a35e02f2aaed237e5784256d97af8912a4cf86526a26b328bfc
MD5 372eb6d3944e21192255901a52bb0d59
SHA1 fe2c4ac489730265aee575099fd3d0c19e13b87d
SHA512 e1fcec98e6d3000fc41976413885a6012546e02592c98cc1ac64e56ba248584833fd4ca7340d545e18aa8856de649a8d044ec0254a6dc0681b0a98f12d3b7f9b
SSDEEP 1536:WMCGc6zkuPVlA82ELFQ2e6sot0vcmcwTgGleYIfb7J9qf7cLFsNx:/cWkuHN26R5sot0vcmW5YIfbd9qf7+qT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

96686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0dbcb95e56c3455c41111967269bce98aa1e2882285991d8046da8ff4909762a
MD5 f15efe1e72caf0119057edeaa6906007
SHA1 8e1bcbc7c8ce7bc657404d19e56b41647447b1e7
SHA512 32ce5604dce539647515c96cf6bcd06d534932d128ad2ff5ed7ed29348806a39200e1d831f9a2396763be08e1324f62bacd6feba939b0111d9440d37a0a4d192
SSDEEP 768:SEwI/QAgtb29dMKu3IfEakwZCa1bvxTXpvXFZDK:HwI/QAivEvbvx1XzG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

40238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.DriveInfo.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c15c58ec4594278a3645f3998e9a5ba02971eee58092e3b9444347ed9db40dfc
MD5 4484d085128730c23c82c8a27f58f13b
SHA1 e620581963564b7741c56c07974ebc6a2d7cafb1
SHA512 68653cefc7dbe9d518a421e2bf5acc89e0f62155a5740b47d526aff6beff57b6abe24ec4f1482aa5250a5159166e0d72cd3a9a12de7cb7044e7e537d282e95b7
SSDEEP 384:AeVCHWl2Yd5zwNyAQbr9DFoV5vyGIRjubW8EWUylW:AAfTJr9DWNejud
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

22030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.Primitives.dll

SHA256 19e6366ee089554bafefc12696e01384c400f75dd967c21b69a883a03c733dcb
MD5 125807bfdaa870cfc41964b5c584824e
SHA1 60b7dbc030731ebb633724bf699885137f758d1a
SHA512 2ffc61cd4201e23abe4e90aa7c124932944ff762ed921508838c52d9f9bc22e7aa6653b29fae83fce016efcfb3d3829816854ffb281da795f2cfa9d21fe18608
SSDEEP 192:YcW/KNWtgkYViJ9xE+1EWULwu0Sc2HnhWgN7aQWs+JxZAqnajKsuCIeHj9:ZW/KNWlEsiD/HRN7l+J/AlGsuCj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c6:45:80:6e:21:32:da:18:fd:8b:7c:2d:db:24:54:8a:c7:4a:c1:0f:24:3e:4a:56:b0:e8:31:6f:bb:65:89:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.Primitives.ni.pdb System.IO.FileSystem.Primitives.pdb

System.IO.FileSystem.Watcher.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 687c4765cba09b495511c33094437c9f89b144c4e368adfe043fb43665b6c144
MD5 e89d148744b7771d3b07707962d2d9eb
SHA1 e4abe8e144647e85dbe3725a58453b8dc339c94e
SHA512 8754ebcc86ee2b9e0f78b557872aa981c28d644f91d042cb654e19cde064d9873f5269c6b9b9e9e3a560cee697ae62618491dec75075ff7633c381a9208b0403
SSDEEP 384:hNKlvFUu2U7ojkK1f4jfljl2Yd5ziNk54A0E3LazAeUcn1NPtrt6MEq8Lang8LC+:ml28wkvfl7fH0i6vyang8Hw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a8c63ed73e3f775e0f2c4708ce194ded1e60dc0c9897d89f9fccffd03aa3b766
MD5 a07b9cf8bb762874c77f11c39581884e
SHA1 dc45e42b5f4268665b831f3dbab1f0948178cae2
SHA512 613533fd9ad40640c6a0af8cf8bf2ad71539a86ef8a6e86ec758f126cb59655eb987b00bcb53ba09e4a55078fca26dc1f62c78a54e52f91015b1d80eedbd6058
SSDEEP 1536:n4JOhhAge4IwnsVxEfqVwyvbsHpG2DowW5k5UzIdAcAJJZA09MddV5kUYffbGi2m:n4J0hAP4Iwszcq9JJZh9MB53Y3bGipxx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

91534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.IsolatedStorage.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2e3795a5d9be56adc671661edc66097e8eba765adcae06727a29482eb357dfff
MD5 6eefa2dbae3c684eb6a8f85d41f7b741
SHA1 e29ec4ac581085470f1a1b3a348c2080fbb6a816
SHA512 c1515a54909756e11ed39dbbd8c42e15fc304f778c0938790f2ba7f76d03a9a89593f9c18652b99b506d2fe7446f63c674e740a483defa62e6dfacca5965bb9e
SSDEEP 768:G11x1A1Q0p7A78fvnTEYaHeWDI7eQqKJf:U0p7AOsStqMf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.MemoryMappedFiles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7c8d373d5d6355200e3984a75db56e8ec0fcd262c10d4615cf204852f7ad4055
MD5 98d05de05522195e24d090e8ccb37bc3
SHA1 6f4597717d81236a7194b59ffa97c143590eb03a
SHA512 1d0cd938f87d1c87c8b43b29e1387baaef9271a7564e5afb68fd310324661ca0f520542c249cebe088a8a6ac87acc854afb835508c3d24a52f533d4196eba276
SSDEEP 384:49jUQtDgBRFULvnAQ2Yd5zbgNw9v2/+d6dKoJ8Li/QqkCMwW5KP/iJWV4LW:O5tDbLfPm+d6co2G4IMwT+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Packaging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 64e1c57c8d441c2b3b98bb662742099165889644da55f281e2cc24888d2be8fa
MD5 941e3abc504d50131bc31e6bc58f22c5
SHA1 8fd7b3df32037cad841c22ad85ae86cab7e6a0f7
SHA512 b4680552ec4fd12d9302b549e2460b2f1499217af489ca4efffe67797d5a5c7b223ce688fdc1e19b087dd4b9a88b037db915ca9f7e7567f2010fa1deb7cf4ee3
SSDEEP 3072:qLNQmGkt4A59NzpHXHOQDAFWS6NpU3HEN:q5QmGkq29NzRZJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

114062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Pipes.AccessControl.dll

SHA256 40f168475329188d5e916f571d3a5168a8ce01e9d617a815bb6e91ac24296ae4
MD5 d256f1c722020e00754920001fbc048f
SHA1 b98645e1164fec1c5f740b694af5780ca2a39bbd
SHA512 1c70079e7a5c5a6d936703539bdd7596d75c027bcae33a13bd43b4ea7cb97b0e95ce90acb903542026d42c6aed9fed6b831806924af22982e11d79a5d7e82445
SSDEEP 192:HLW+J4W2Z0xH+GjWULwu0Sc2HnhWgN7aQWugoqnajKs6bH:rW+J4W2iHfhD/HRN75nlGs6bH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

db:f0:73:24:1b:b3:ff:9d:3a:7c:58:29:f1:4a:c4:31:b3:49:80:3c:ac:20:c8:c1:5d:19:0e:e1:6c:29:81:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Pipes.AccessControl.ni.pdb System.IO.Pipes.AccessControl.pdb

System.IO.Pipes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2c6ddff65415c942bffb5fe19a1d8eaf35038b2ffd8b6cf858e62faeef257f1e
MD5 22b9bbcbda868e963eadfe1937bc4767
SHA1 ec22951734a5f7bd6b2832bd1df3716cc6c488ac
SHA512 7608150884bbf04cb81995d5ec183eea41977ddf5477881724141780100ff75b16208c26da613794820485c4e4208bd0a5011de3ac630ff6f3748512cee96eeb
SSDEEP 768:Dhs3o27tiKh2Zfkb4Vfl+U9YaZqy3wLZDd79uF2Kmp1Ha6MNrJOy4:ds3o278Zfkb4CqYGgLVdpbKmarJt4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

59694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Ports.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9db67e66a1489519197dd6f6ac8459a8707e0cbf2f4d145cd840cf06be27b51
MD5 7824adc5ad89404f606ce21ed2b010e8
SHA1 8c9785db2939f922eea7361af93050e01deff245
SHA512 5d8a3a2725117810bdc851f3491a2687c792571fefc968aa06e98bfd4f147281e8f5f5f168dfb5eaed0e9dfe7025c032e38bcd1f954e0eeb44a3b6373d92ac6b
SSDEEP 768:nE1ikiHVWVpYmHqXs6Un11fF+lTV60X5m/Kn0AF9BH6BraCgBzZbuxfm:A2WVn1Wh60WQDHmafBzZCxfm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.UnmanagedMemoryStream.dll

SHA256 f16ecbb109919b63e0e9fea365f6d079e4c89743f6ea3fa288b5549f60722ab7
MD5 36dbb30652091efc5824368cfaeb4ad4
SHA1 005e3e082d14f89307abca0d1a0d5d288f239dd0
SHA512 7144b5d72c400c57107ee6f569010146033c1515365cccd29dbba4a09230e2de217d263d322ba527b6b5c1984662d4c30f99c0a7162ee28b9c2a78057da11cd9
SSDEEP 384:IWjeZWhwc/dvpMD/HRN73qWwmEy4lGswnyyww:wEww12Dv67y5dw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

49:1d:86:7a:6f:fe:4c:3d:43:aa:f3:68:24:66:09:92:fd:63:51:33:83:77:2f:22:3a:65:4c:5b:cc:d9:12:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.UnmanagedMemoryStream.ni.pdb System.IO.UnmanagedMemoryStream.pdb

System.IO.dll

SHA256 d9513f444cedbb40580a3ffbbfdf6a8e70e067365226306f594d880b68001a72
MD5 53823359850404a64c69df4d196be68f
SHA1 fd21d9a9b1a691e63e9c2977b9f27569f6bd1b6b
SHA512 a21925521e14bc4ec9a846615ece7caf0bdd49b276fb6256852a788403a2a2b10ccde2b518c6fb52eeadc7380a5f1b5f2d356ac770a7b389d42faa7ebeb8d7fb
SSDEEP 192:KjW21MWX+W83Txh+qPOWULwu0Sc2HnhWgN7aQWyfT1XgoqnajKs6dH:wW21MWXv83NhfgD/HRN7BfRXnlGs65
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f0:05:45:6f:e2:e2:d5:22:e1:9c:bc:32:64:c4:a3:8a:3a:46:02:b7:ce:95:13:f9:8c:fb:44:48:aa:dd:ab:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.ni.pdb System.IO.pdb

System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edea742d7c32b5b0f7ddf76284fbb734c5b37aaab87ae45a85a345d87b48842f
MD5 4914a06ca39c7f5eb6ca69eb22dbfc30
SHA1 0f460d1bed4348c6207fc62b3cf321c0bfcc1a9b
SHA512 3ac7c7d549efa3ac8e2c1680cf1f3a6e7d8dc2267ec884d3cb19e0b2d7a49743549d8335db5244790b73f7179d58db2e7e0530bb6dfca10a8e15c1e6ab681c77
SSDEEP 6144:evBFsMm1bUIylLIOM/1rYUMzY5hBOTAfOPOUBSBYHNlJfnZSL:eJFsMmRCsOMtYPC6UOPOCRgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

546862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Linq.Parallel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b656234fabb45bf651b0ac8b5ede0f01fb67436a2d115b02757daf477865f88
MD5 ae64efc029001b20dd268193542468f3
SHA1 ee0455999156faa1e399fd66cd42e77bcb61658a
SHA512 abca4fce3f05b19e648f1950c37cc60cff18a5521d0cd05925b9e8f1194357d90be26bf786c19104c1caa43b2d3f61b6ad2606b479db1dcc3db08f21a56ceb05
SSDEEP 3072:1dTedrb/Lw/k36UIDvJ1AYro2rlyutytsf7KdBp:k4/K0BhlyutMD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

215262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Linq.Queryable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 987f5cfd1259a17491bf6cd63aadea2cfa2abf550756064fccf0e7ac6cdc3a60
MD5 3713aa70f527efcdfbc3d9ddd9a1c85d
SHA1 40457263437ec353e9afbbd0ba33682e90563f7f
SHA512 051612634f3ecd8624a6e6d6754f108e5d75535f8fff9d9bf01825e92f02b630e416364eec671ce92c116a6d55e8495aa83368a29041488fcef3419314ce58ba
SSDEEP 768:gjFL9MkIN2bACHMcpcLWC70XnxNM1I5Jvzf:gpqkIN2bz4WlXxNMmnvzf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

63854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ee49ea51b5cbefb9ed5c43f5f9dc114ae2c6ad08d21170aa5b5b7565898a1788
MD5 0839b4e0fc82f691eea956d0e62abdfd
SHA1 1c7d78c8c397117e5c104eefe608741a9d900aac
SHA512 41d3816a02cf54a349552c86edaada5a9b5c657e6c9f91b8617f90fe8d5f824bdd351f50afe0fea1c03d26fc77e1c2dcbaa6d7c43cb56a80ca811488395e193e
SSDEEP 1536:9OA+EyGUSp6xpWLdXUXZcgleTiE50yTKy5Z/caUmztQ3CO1xgCdRRBeXb3NJTG:gA4TSJ2ZVkTiE5DTJz/cakfS+RWy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

132894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Management.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 342015b3457ead575893f97ccb882e7cc2af932b582223d30771cce65d5308ab
MD5 285ffb3fe6bc4eccefb054d3df9fc624
SHA1 5edcbd41f0410efcbfb9a73063b34659f83f145c
SHA512 dadc0f7f61521517f55a38c777887be42fef119445c043a6004262258260f170373de5cefe4a809602a5c1839137bf5599e187a92b761852891cc80537bc39e0
SSDEEP 6144:4YLz4kuJ7BBTiVPDkoknzA7PDDyn+Z0q:4YLz45da7PDOn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

289694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Memory.dll

SHA256 e68d42d7013c0bb25a9db626b416c9e8bdcdaac42c5b1e3f103b2084fa07be60
MD5 ed1616b6d3b370a0c248904217a88a67
SHA1 fcdc771fab0309e8dd7d51b2fb50ed249de424fa
SHA512 1821b564b37f583b2d1fca19f412330d8a00c52004ef4d07259d4ce009752253f642b7f0d04da21630b8dffe7c9f3e445229948299bd7d6fe69385fe6b091f00
SSDEEP 3072:TzoXZQifNc8YBUDatH9ZqsxwgQF0f+xiZR:voXZX0btHrqs5QyfKK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

77:db:e8:66:ca:78:f4:3a:6e:57:8e:6f:ac:23:60:c1:0e:94:a5:d0:7a:85:14:0d:44:23:2a:f2:30:b4:5e:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Memory.ni.pdb System.Memory.pdb

System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4bd28985a127da6b2a5216456cc923c1f6180e25187a8f7a94f458866989d5d1
MD5 205668ccd525af905d8abd49ab2972f5
SHA1 c6568372a94f9525d9f9362980dfa5183c75ec54
SHA512 548497f168ff808f6ca637a4ada0163e55e427aa5afd1f27a35f7bfdfc407232cf6ebee1a87757cadd53e5da5c84135a6fdab5f8b4013b6da26c09d021c81afd
SSDEEP 6144:gINEUmBKWQCCBSQ7HpB63iB3uWTZgfcZD2STAheOpYMxtNWV669pFYeBp:gqEt0p4Q7Hf63S+WTOoqAhYe3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

538558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.HttpListener.dll

SHA256 096428726b7834efb1a9753af8d073ed15965dad48976c982de7da37b7073f64
MD5 02793617ef6948e1eb8a4be14daef04b
SHA1 7c35590de67089419200c9460bd7108e71e96386
SHA512 4bd98d046b6d66cf09a759d612263895ff538b5f602ee91515a7c75c61887f2fc42bad5742abd187ae9993a3e73bf30d296c6e52f82dbd8645b136b8e60c0418
SSDEEP 12288:WqbR16eYC5XSYqWqYzXj1ere51nTX1aLUpj5NT2:d5SYfqYzZere51r1aLUpj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:22:3a:40:c2:32:56:cb:c9:c6:f8:db:48:26:9c:27:a7:3c:20:7c:d8:94:54:89:20:ff:3a:c8:04:34:33:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.HttpListener.ni.pdb System.Net.HttpListener.pdb

System.Net.Mail.dll

SHA256 8a582c8fe23533f3a1e1e0f143afb0ab7f7d65b6ebf8f3276779c39933c322fe
MD5 19ed2a3be2585c512d7fc4bec231d143
SHA1 31cde2f06e0f7d2630b65bc55db2c3ddfc6899e5
SHA512 d0dbe192789f1c8a0c87f42683094f030330513ed98d44ac92392abb62a28cc33ab9c4ad1de2313fb30355c6bdd2a6219be605cb9dceb8db13f30a3beaefee01
SSDEEP 12288:tkbD4401IQ44A4agbfdLG7HXeuuHGcTLfrmkd:tDbFy7HXeuYxLzmk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b1:fe:c0:73:ab:a4:1d:08:29:82:ae:d6:22:a0:e9:50:92:4e:54:74:7e:83:26:72:01:a4:be:c7:10:2e:5f:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Mail.ni.pdb System.Net.Mail.pdb

System.Net.NameResolution.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9595debab0d27decdaffcfd867bacb584d3b0b81b8ad658b83a302ea2af9d2ab
MD5 b770f5c5948faae290dc86924cd5a76a
SHA1 850c46117a9705038aad9e4e075f0055c9ed3f6b
SHA512 3cf3f2c74318550ef023d9ad3b98b025873182a2d641f579ba5506c658121e9fe2cf5a4f4dbbcbeaff8688470b6c315985d5afd92b7d232c19b57768437f2fc4
SSDEEP 384:3oo9/aC8e6+EfoaUUW/8X6fGA5nnIZOgSsEXSNGs9qh9iDp8QngSTZ5DcKckcsb4:c2tEFUSKfLnn8OZiYs8aGQgSTZ5Rk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

41582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.NetworkInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3cb3c7137916fe5c1a4a9fbb5edf38148936505edd9ac9746709c35c91abf95d
MD5 830fdfe6c063e8e10c15894ee5c56441
SHA1 40ad4a3610e90df8df2200dd4cb8e4846d406575
SHA512 280a6a6494a6bf5b351be6d84c8a499bf2db875ec628426a5968535821ee977909ca3f813c5238e4af08c64cd88ea572e7a485936d6142ac4c01b682f9ffdddb
SSDEEP 1536:HAmshbr5UXLwlQ6F/9CoQp+42e2Ba6oX6YixAuFI3q:HAm6rmwp2Lpse2Ba6oX6YqAuv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

85134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Ping.dll

SHA256 b36d0e7ecf0308b42581334a3262570f2475adeebf6c0b9dff49b3c504f167ff
MD5 6a15e9cb3e74e2a6a2fa8ceb0d0217bd
SHA1 867eaa2300f222221c10d92268600cb3eb030d19
SHA512 03567ccec7ca81d8b1194dcdc085f4c040d6c0e341bca42dc2c9d2dbaafb43c6229d687946480a370392e83de84d51ff975310ed70a011cf49a3823623563b0c
SSDEEP 1536:aktE8ZojpxJmacauc1J3Tf7DXmIHN/hLlQ1mYaaIvj/x:aFpxJfbuc1JjWIHN/5W1zF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c2:d6:5a:6b:3f:79:12:e3:e4:32:15:ca:3a:67:80:cc:68:d4:81:1d:54:a3:9e:b1:cb:45:73:8a:e3:65:74:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Ping.ni.pdb System.Net.Ping.pdb

System.Net.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfe335cffc58363cf56d78b3ca19484e3b06fb04a9d6777e3fc9caa5a8f7261a
MD5 cd19ad683b3197252ae26be3289115fd
SHA1 622d882bb8dfdf27fba5858c60f9a8ec64c6100c
SHA512 d0b1243e732a1afcbbfbec0d2be44b9613c6dbe533cff8734088dbb3ea2543f7691cb878d5e351e1913ddffe78a762627729881f829c4f8a4a4c2078e878740a
SSDEEP 1536:PawAVSlfXBv4jsWosPhMZF/mFhK79KwLrcfz:PabSlfYph2F/sI7qz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

85118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Requests.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1eb668cb3344f0847b3f36e81aaa6c14a2fcf8213ab3057aed4de4ec3c5c3f6e
MD5 39a35f5a6b80d409d8461dd08737de4a
SHA1 9c5b7f27982e9874f2ef234442cd8891c4176198
SHA512 b6a89ecca83144270a36dcc4f0407930fe3a94c454673d635a9c64e15c4f5a316e81ac2c68045a56630e0a3805a5f570f4e99de3264dc4c0de3cf5e67f00afa9
SSDEEP 3072:79FdHZiK4fD/DNv2X/b0hLqsZgvQodcppWGriw2P:BIKafNv2v4ssqrcpj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

135790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Security.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e64a67976dd5aae922071eeff3ef77c7df4e29322d7a246d352de8a1ae262a9
MD5 0a580906417d9db344bdea28c003f907
SHA1 f576df1d32f128160278062caac1b959068a6a83
SHA512 4040d84586c04c21d695e977246997cc20dd7a0e5058ea451679bb3a2f30cd3da5f6843e1f9dbb967179838fa39fc3c05619b13ed28ea419e3d88ad50911cd88
SSDEEP 3072:ZhJ3n0/B7wWUR+NyXg7trk7OpmrnI7/X3gZyx8vBKgbqJfQLGD9B0YIL:vJ30iPBqnbX3gZyqvkf+Ls9y3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

231086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.ServicePoint.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5f02d8835a8e839e49f1e3b659283aa761513647f52ea4f59c6e47e5ded789d
MD5 497b53bed88c0f804a083a5f95e49eca
SHA1 a4fc8016e3750b54e7849b0cf85f48bd4fa333eb
SHA512 636e7b7528d9d0ed100e20c29fca50423cf463186b2eda63481913c2c45ffbd29be5e69bb23587a0a3a52f3082e585c00829c46e089f69bba88c887f406f723a
SSDEEP 384:ctN6w9evlPN1pxTTga2iyQz7CA8SW+LCW:ctxOlPX9V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

19582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Sockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ecb210290f0350ff9bf6368cb71128ad34fab88d86b743d441a2e70803e9b3c3
MD5 77229ef0b7df33ce8c4a26d811fe3492
SHA1 aaf3ff988cefcd706f420b135642f4f4f870782e
SHA512 b5b287e04073b97ff8f2f105308061a7cb34613cdf34a9a7aff0f047af99537414439269b92bbb7fbd6ca6c5f32a7a3d1c152a3d51494ff82801e2e30789325f
SSDEEP 3072:aiq9PVTL6Ix1iTlUfUhTvnJkm9gulQSHkye39wugK+PADf/wSp/rRQoS+Knk2J9g:y9dTL1x1Mg0TvnJhgrptojPXVk2J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

198414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a6803df2ed33e027e6a529ba7f700730841de6ae75a53c94121cbf92cd83d17
MD5 d8abc58e5fa2c478d0a1aa7ee8505c24
SHA1 816819d8fb74cdfd7e8765eabb6cddb77210d0d7
SHA512 6b3b09af1f4ad2bc25d2e6bc073f36267164e49c397c6ea6cc5091c3a4231c1bc1743ea8d382ef450d9c9d4476d76ae51adce441f4373c78400364098f834c90
SSDEEP 1536:gOb+9zNGhv3BBBDzkVFUunU9Y3Bv4HWiNcWe:qi8oY3Bv4HWic
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

62830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebHeaderCollection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d8b8f71dd700bae9b3079113a2738f166c58551a723cae6009a83e6ff8695e40
MD5 8e073cf490c8bcc3a9196fa277d499b8
SHA1 091fea2ed4f2c214b913f14e4de27eeeb65940be
SHA512 feced734e0b47e0b3725a545325deba35224c0260f79814e87f8fa471aa83ae625e3378214162aadb875ad7ddd835a47f000885b8f8e6a4b1d6064e2928eb716
SSDEEP 768:ri1zFHQTamoc9lj5XQq1AK1SB8Svbjrn:NamoclJ1fSm6jrn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebProxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6d817dc49a215978fb7883396795a76b0afd713a0966b5d9521948fca8963393
MD5 2332b43ab13c57e40e484f6be887621d
SHA1 1ae5cb46a554aa25de4514758dcc84967305e22e
SHA512 a39cc97daa0e4ca2d8c4fde1af6f26859700d35f4957baa1c8aa0e6e460f03d94c1a4a154de0648e28c2cbebbc80568abac66e7fa9d1ade16c27c7cd1e9adbeb
SSDEEP 192:NVvCGwUTASSbEBch3Z4Gz66qWTg3WpsnW:pG94BmGG22U3WpsnW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebSockets.Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 66380788753f403ee5037e8023784cea7e10cfba5e968df674645f91a44ed210
MD5 07142001859e858135f00fdf56cccb8c
SHA1 b708e44a1ef4f8070a21261424b2694178321c8c
SHA512 caba63f443ac9009f64fc8d1e77f1c51c6b6e6c8b3871921e48c8076137f2a3eccdef1df9741cc9bdd13202b5e371f0e73eef116f048b587ddd980330473f845
SSDEEP 384:FSaqJtTMg5ynAw1KWEobT4pj1C1/fY0044koqB4sYcWqovaErmDg51EI111jUdah:aoGIAwIjIZff9oqccWKEr3EpEbWsVwO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebSockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 03671c2d168a51a3df53140ee0ab0842399bd45d682181225fba8236dc250ba2
MD5 0e00b1741283c22fda27bfbea18c7c86
SHA1 40b5af5cff1127c6c03ba9aa9ee542948bfbf5f3
SHA512 6fd724ca6c1d8363febe43c4deff1cf5b6e6153b823ff5fa1b631964d9e16b37542a217bb4390adfdbcb9c4af2d08d69b693162e6fb563182affe9d5bc4b07d8
SSDEEP 1536:9kurgAteFF6majUl65ZYfbIpYDvlkEqSRwA:z+TjITYfbIpYDvlkEqc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

56078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.dll

SHA256 945f687dc33b6c129a58ead8e0b379bfe684995671d455ca2f945cb2c7b3ce13
MD5 f1a0f758837b7e6a3b2c81e914cd1947
SHA1 1ff59bae9764b9b36c400467e1e1cc8d9f821aa3
SHA512 2a24c60b6b88bbdd99609aef7bb8956cab6ee5009997c9e6c85423856fec18bcf049c4b7a30107db27f904ea67147c575d811cfc7226a8a353cbaa557d4bb786
SSDEEP 384:mWoMV9WCm313QglWnK0GDgD/HRN7Cc4UslGsYP:ptM132n+DgDvCiF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

19:95:3d:e4:f9:4e:c1:bc:b5:04:8d:08:fc:7c:3f:78:34:e1:ad:5e:7b:39:c2:63:7d:91:35:3a:d5:87:d7:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.ni.pdb System.Net.pdb

System.Numerics.Vectors.dll

SHA256 f8963cd1c917c2f0907d8c38da1ebfd879ac0fbe135eaf80c30d0a5619a27c0f
MD5 3c31ca40f1e8d9955604078d4a4c0599
SHA1 fbf2bad349b4f59e8f01300025fad971ecaf508e
SHA512 02f206904f3ebc6a81146ab18e622757102bd74009461599040894190e66e228f97bbad35b28b23e6bcc30aebaeb81688159450b3019c61290102b9a190cab4b
SSDEEP 3072:OPuHmcSg4eGY3mIqKJDbtrrkYLFQI7LXNbrj7562Ij4b:vHmcSg4eGchzxRU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a5:3b:f6:47:4c:bc:d2:c5:a8:64:22:7b:de:3f:96:e8:41:fb:9e:03:d3:f0:cc:7b:98:ee:74:ca:14:e2:bd:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Numerics.Vectors.ni.pdb System.Numerics.Vectors.pdb

System.Numerics.dll

SHA256 b3731b31d28ab7a535a128ea3aa47268a6e00b44ed56e540ed97076deccdd61d
MD5 56abfef7a5b1440c63eaa88b2dc937e4
SHA1 14d6e6ac91a5d6a12db8f337f7ea4f1ddf6ae1bc
SHA512 a6b9ca5632b4a7682140710958981616b755d118f8b501d1acccbb547dbe6fc55579a2449152e03d4c0307647bcedb53ca817cb2539645791e6ad55b008308b4
SSDEEP 192:wrWez6WHXZ++1w1TWULwu0Sc2HnhWgN7aQWDh8dTJxZAqnajKsuCIeMz:GWez6WoAw1RD/HRN7YETJ/AlGsuCIz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

72:84:64:83:89:45:99:8b:73:df:01:a7:2b:bb:57:d2:6a:2b:a7:6f:cc:6a:1f:fb:b3:01:9f:a8:28:85:8e:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Numerics.ni.pdb System.Numerics.pdb

System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5c9ad2e490abc382885ec0b7714011aaabbc5f61f544d8ddaec7260d54d35c63
MD5 091c9981c61bf4e318ee77eae1e74265
SHA1 a0439301fc2b4301fad8fd2dfaa1bd35dcbcd624
SHA512 c93a51e81b8a847b420f7e97be58ee98b0113ffe082d6bc4faa54237f227a88b35e5dbc6b30aac5ae507b9b4e7c9a499d614a77262cfaaeb2f70402133936607
SSDEEP 384:UIjgf2esahsGrZpibree6YqeuT1Td25tNPGXrPpoZbARXLapa9a98ktPMGaHWlsy:U12esaiyZp4+haPGXTOUAZ+HT1Wh7w6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

40670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Printing.dll

SHA256 118333264319aa602c82a164725377cde6bbb5b98d9f7edb1e6ba886ff61bf76
MD5 ff72a0a932e6b085f7f515d9fdf6add0
SHA1 cccb86494b596c7b1146437d6e76b051ba9da775
SHA512 56c3513b4d4efeb32a7750eb9e57620094f7445c9bc614c3a4e658df15cb9987bc597048139832be8c76ce80ebff02623f42ce1b494ef3fb7b7905be2adc6f89
SSDEEP 12288:sfoGuasU7dvJVBwx6fnkiyTujve2hAFai2HKDx2aUQ:CkUJhcPiHjve2nKDxGQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

92:df:c0:b6:20:b3:e7:a4:51:26:15:35:a5:2e:8c:41:30:f7:de:53:db:6f:45:02:70:9a:15:3b:df:92:dc:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Printing.ni.pdb D:\workspace\_work\1\s\artifacts\bin\System.Printing\Release\netcoreapp3.1\System.Printing.pdb

System.Private.CoreLib.dll

SHA256 4d75bb725e7cb7a33106ca74d5505d8162e854e2b9ba4faf3a8f42655ebc03f9
MD5 80f764e4586ba8ce3ebe2165cb2af8ef
SHA1 476a5c53516dcbca07b33d8aa86319bc99068ef4
SHA512 c00232c584a0a3b1dfdc5bdbb691638ee0055c717ea4d356044bd35893cd92a16acec65c71e601105587836a7603dabce5c35fbec22f41452e6ced51146713d9
SSDEEP 98304:YfUbeJNS854p4klcCKZqVnVjdVquedkSmXxR0NQaMgZ:cOIXA4gcCWKLouedkSmXCQaL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

62:a6:43:96:b3:44:49:9b:5f:e5:85:06:9f:8f:b9:e7:7b:6a:ae:ab:e1:a1:15:33:93:fc:f4:86:14:fc:bc:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.CoreLib.ni.pdb System.Private.CoreLib.pdb

System.Private.DataContractSerialization.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ba3706fee0534b027c67370ce34f42218a02559af63a11903a91e5a8a6286acc
MD5 86250fc90cc9c567c8e45a2c9246154a
SHA1 271363002fba3260985da7ec054c06ae55446e85
SHA512 8628144212c206c1bac07f220ccf1095a5841a9f0be5bc8f23cc0c4d2461acc7f75641a8b26fd363f8e35b9df1a9b7e9d2d9d20464a030bbb366826e02885b27
SSDEEP 12288:lqPWD9DLWJh1GBWIkakMOQFnl3F/eda8VZQuRX1bZrYdISbfDYa6gNT3NIod4YcP:l/RxX4XTrH/ynmvfv3URvObvR0O2lkL1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

760030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.ServiceModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ab6e88a223b6f97b565df52c674e67b18d4733bd18e0bc08e06f6f1c83dae5f2
MD5 8c8bf226b53bbd00e7e1eab509b54045
SHA1 36309c8626d76c17cd328403fa48e5e73f02ae68
SHA512 da4a93ccb4bc48e8b4e6ec50557a3fd6bcb1f91dc2b6cf9d51bb75631a791efe3483e2fe9630d913c8ea471ad8ea02974ae2755600a809f2769ad9564a371880
SSDEEP 49152:jWNyY35MeyPAjzRi0HDeSRzTxLz5S2Br:jWAYpMJ0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2306014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.Uri.dll

SHA256 fc67f9c1ae6095a982854aebc8b555ec3cfc043ec076c219f43dd4120a8fc644
MD5 fe7413cb6d53c48ff54329f573fe0cba
SHA1 84cb163942b1be365c6765c6b9a7539de21b2e52
SHA512 53980f85af7b686feaac49e30a9e29b74cce67d359bfe2bbe75662af7fd7410e7f6b91ac65c07126ed1be1d64fbc0e744af2f9ddaf998517f4a951b3e134d0bd
SSDEEP 6144:x6n0hhQLAIN3TZ0b69lgbdTwdRiksjIwKtM33d+dCMfMPMhMpENpQxxHwugtvRm+:xFBG9w0aLiB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8d:8b:10:ea:46:80:6c:cd:30:0c:95:cb:f1:c1:f8:59:dc:27:e6:5d:f5:46:df:83:97:cf:7a:49:53:67:ec:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.Uri.ni.pdb System.Private.Uri.pdb

System.Private.Xml.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3687a6a667f761c5c7e791f9439bcb128d31d817d4a133e483e60893f81e89a4
MD5 762ceb97886c1f8379a9101768d131fa
SHA1 45a599e4f3b57ee014ada710374f67f4aeb89046
SHA512 5a25efe3a07facef91de79f06695aed6d16b2e08052cd4d995497b6dc27e99a6b68ab2d205fc9a410ed7a7e753e6aac03924496ee3e5d0152241bfc122a21ef7
SSDEEP 3072:i9/tzI+k4o0RIsXQSaPROlZWxz5tPEWmjKt:4o4zmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

138798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.Xml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfb5d0a2ce06dc775aaa10a70141cf570d4d0bf350f43f0b3c1d49ef41dc5495
MD5 a06e5d444ff44ef809d34e6429333889
SHA1 d967e9927d8f726fc50401c98e5a33c914fbafb2
SHA512 ca4927ff488199288fac5c91c550c096ff084dc5ac465a498ee39c42de1a9b4bd771305593e0b68fab96e81d0e66f6baa75451a00dc73ab026df282ac78fd8ac
SSDEEP 49152:NSnsNtxn2m0+5+DlniDRYX12x4FbOvKm:NSns/xL0o+gDRYX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3059422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6b05773621a83cca542e4f38e2d2d44c5325e88b75ea43a0eed7df38521f4b9
MD5 bee24da2f0c8eecba68a7cc8db032064
SHA1 8f372aaf605c12b5d366d5165514db1cf746b8d2
SHA512 0f6942b2b3d8bb3f104b5f95131142658571364c121173593741e2fbb3ccb602998e0cb6042cf4d2dbc09392d89cfd04889b32d5eec36d94abc4c1a1b152826f
SSDEEP 768:/IvrtAhlwUmVDAPM2Dd8bhpCCxWbm3fsdlJJVLwK6OHf6BW0kXxHINkxnaG:/IvrfDchqSb7j7HfVxJcG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

73486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.DispatchProxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c494bd209b461bb7e84490a9dda79bf5151f6190dddecccc9b02bf19f5c8ffb
MD5 4a7811353c1cd93585662b305b7498f5
SHA1 3ff9fda7f4ef6dac11cf6ef4aaa8f40a8a88a944
SHA512 c2e3b0b110451acff38a09018e77a08dd8bc8f79cf62f741ed751be0c0cb59b00b8afd2bc415885c36d06eb71a0ade64d5b90c67e6d63f0ee8f75a69dc02ae09
SSDEEP 768:quwrfz8RGcKkZ62WaFXLWCbPru+g3LymF:Fw/kGcKslNikju1R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.ILGeneration.dll

SHA256 c7572343096ba3afda1e8906a35f48431003be34fb951fa6d24d8537d96d4a77
MD5 5f4a1b2a5b025db93719297b325a6bb4
SHA1 033398f2ee8b20f7bc4e73a765bfb42a04f4379e
SHA512 f123722ac7fb7be7e4766998ae93bde7ce86b836ef87b35c21b56675709443bd022031f916a24beb16d947e4a7f800b2a16335f9b4c16b603d1f3c20f56ece90
SSDEEP 192:UTWVQDWOwnHx3+y3RWULwu0Sc2HnhWgN7aQWu/j21EhqnajKs59SiU:CWVQDW3nR3H3LD/HRN7z/qslGs59vU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

40:51:df:c3:5c:73:fb:66:a6:fb:a7:52:95:a1:2a:37:b3:98:4a:00:9d:4d:b7:94:06:a2:78:ce:df:e7:ad:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.ILGeneration.ni.pdb System.Reflection.Emit.ILGeneration.pdb

System.Reflection.Emit.Lightweight.dll

SHA256 9c2beafc2f91791ce2e4bc4df07d36e8d3ea58e4c65811aef7b9120bb4b5e284
MD5 8b1c2d4c8135224ec5a404e1207781ee
SHA1 d2985cf9512951b564d4d405212a7b7f28c6fdcc
SHA512 f15c6426fd2a5d87263241a7c8ac41ac155d1ef122d1cca65610a79a7c7c7951e29b50125941a476bc8573ace5a00d86457dbac3d177672df70932fba0aa03d6
SSDEEP 384:3WxFV+WN+HND/HRN7cdwwmEy4lGswnyUC:GtqNDvQy5Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a4:44:0a:03:f7:ec:06:f3:4f:38:6b:f2:2b:3f:68:cb:59:41:a5:55:3b:fa:46:dc:6f:dc:b9:dd:9f:8a:81:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.Lightweight.ni.pdb System.Reflection.Emit.Lightweight.pdb

System.Reflection.Emit.dll

SHA256 695ccfe1fe7d10cebc4ed914434bac5f1b4b72de118263c649ba460667872758
MD5 2af0f69e8cab88b90cf851c1184d6832
SHA1 9160fbc131daf5b30d1f5b243b8c385410bed515
SHA512 28a0b6f8cc64a8e5da56080e774dac34150014c70f25030a68dbbf373cb3d6cd6c1191c9af67458720495f372519491ebdf36e84ed3ebcab4eb0a932a35122da
SSDEEP 192:Eb4LLW6MXWWp10Ors0xw+qWWULwu0Sc2HnhWgN7aQWfLrMhEqnajKsn5uqM:fLLW6MXWW7rsiwloD/HRN7MjlGsn0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

84:89:09:d8:97:17:30:27:5b:cf:ff:12:19:74:3b:57:3d:c4:11:d9:9f:75:21:f8:47:91:ef:58:9e:d0:f5:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.ni.pdb System.Reflection.Emit.pdb

System.Reflection.Extensions.dll

SHA256 9961b253bc4e79e662bbb6288ed85a4dfa1c7df5620efe637b67022ae0fda9e3
MD5 fe0df55b097a97fd3597788af94d835f
SHA1 fbeab799abd20a2c534ec386f1effff8edd40c0a
SHA512 d07dce5eeba6c91b57fe2489f460f107e729aef581d78e975dddf28852507ed7df28fe18652bfa2fdc9ff7931dab528a32a24604e4845ac559cd621f8d261d0c
SSDEEP 192:lvWK2BW11ixW+pqFWULwu0Sc2HnhWgN7aQW8VH2vArqnajKsYBCz:9WK2BWLoWiqvD/HRN7DH24rlGsYM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:37:ff:dc:32:0d:46:ca:98:02:d9:5f:c0:02:4d:e8:41:dd:aa:ec:be:74:0f:f8:67:11:7f:2e:8f:72:76:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Extensions.ni.pdb System.Reflection.Extensions.pdb

System.Reflection.Metadata.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30f553c17ab1185e9b05aff85ae08e4342bad3f2fc31b672f7972e46adcf3c66
MD5 f2700484e2f88693b7f4894c42dee8a5
SHA1 ea1e4abf4849376c2b2a06af4fc966e5034d7016
SHA512 5bc03c186ad05546b2122cab7cc04441abd5c785f76e9856a5bc1f6859cc3678c6441615a2966a31387246a06eb8189697802d5b2f133d7bcd90abd5b7aa9a4d
SSDEEP 6144:MlyP5TcGa7o17Xg8ZldLTnCp6hvwAebTidk:Mlw1TldLTnyNTw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

439838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Primitives.dll

SHA256 e74e661217dbac9efcbbff55fae225a94742f29a0b68ae7a856887a9dc017ae1
MD5 d6f4482fa8f9c0bb2baec7040460a322
SHA1 d6cd66ffb48d21e824d9b98c22b425fb8916865d
SHA512 4c68b85927ad370c436090e0c6ef73dca256a5d857373b11aff4e78b93c7058ce5b7558fe2d0b85ee94ceb9b40b5cd25b20231db388fc28534f6cbe86a0d2841
SSDEEP 192:P3WSOZW/5lU0xr+KTWULwu0Sc2HnhWgN7aQWPJxZAqnajKsuCIeG:vWSOZWRlZrNRD/HRN78J/AlGsuCK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e4:b7:77:ff:e3:63:2b:24:ae:68:95:26:9b:00:55:5d:bf:78:73:e7:56:32:79:3d:af:a6:5c:14:8d:4e:c4:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Primitives.ni.pdb System.Reflection.Primitives.pdb

System.Reflection.TypeExtensions.dll

SHA256 8ac5b82cc26ba73a60238ebc8b92c73df5b391cb8070e8e82371d4843c06dfb5
MD5 956cce5e18556e9beffa8e741fec104b
SHA1 c9baac41ca034b71e77d08fb0e26f174fb7816b2
SHA512 878c93b6de7a0c73ed07a9eb6a6561475e2e23f2f8f5bcdf06e407c03525ab2f9def5609a3354806e132f014a425dd23245468953cbad4a65a25c7734851cd1e
SSDEEP 768:vJkdbrDGaTnNmSux3UU4d7hIKeJoXE8Cpp6IXEUoyBp7p+yV2R1NLhAkDvg:vJkdbr7TnHli2dhA+vg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:28:86:d1:96:ce:5a:a3:9c:59:3b:76:8b:e6:54:3f:a1:04:c4:89:27:43:4b:73:b9:17:b6:77:1f:a5:ca:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.TypeExtensions.ni.pdb System.Reflection.TypeExtensions.pdb

System.Reflection.dll

SHA256 02421b352da2c68e768799d9fc6efeda3b777d3c5e828a5540b24add9c4c801c
MD5 9dc9f9b82a1fd65669349d5de721844f
SHA1 77eefccbf76bb1528ed7a00386ed23d1f6d3be61
SHA512 0fa05e463aecf4558e3f409d626527421528a7ffeacfd13aba22e98b69ce3c793164738413a049596c390cc9f05a6a2e857bbcdf015f82344a55ada8c7f8f7dc
SSDEEP 192:7CWhC1WigegK4btkxV7+nEWULwu0Sc2HnhWgN7aQWATLhMzqnajKsIhpqC5:WWhC1WGgKV7miD/HRN75VslGsIbqC5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9c:24:b7:84:fc:ba:25:84:a2:d5:6a:13:09:21:a8:5c:c9:56:d0:29:4b:f4:8b:47:b2:75:46:26:63:b3:96:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.ni.pdb System.Reflection.pdb

System.Resources.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e5c30d3f59560a4e629d7c59566d5c22ede532c82226a375d81f56bf8dc9aab3
MD5 13a831b62b4364e91ce55dc83068edf4
SHA1 0ebe6aef77ef954bf5be582c6c13b21430d9c9bd
SHA512 7f6dd9afcb6dea90d7c4464b70da9cb91418f37c72f061304c7a5a1910698719e191d8609f74b82111feaecaa814bd277da390e9c2f6ed8a144b0b59dfcf961c
SSDEEP 768:WfUxAAOW/XzXQmD6OSbt+tiTsosZ0yh3aKAEyYzzxbv0U/ThYCDm:YUu9Gox+IsyEBv74
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

50414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Resources.Reader.dll

SHA256 c93dbbcfb1d69803c58d77f237ea4ec2bd3891be3eb23ed8e70471f8fcfa081f
MD5 9928e4487cef79f5c9c0886a0ee852cc
SHA1 56009e49737046c9249d5ec56e7ab2e7c763e932
SHA512 fd9d19eebf398e1e419b1b4817c1cbaf28a9c531a3f75ac9c5b45648a8dc1a4bec33d444dea4ae72091c79df13351d0bbfadb4a638ac1260c33339881210dde0
SSDEEP 192:ObNW4RwW49Yrx3+ygmrWULwu0Sc2HnhWgN7aQWF+U7goqnajKs6:+W4RwWYYl31g2D/HRN727nlGs6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bf:c6:71:54:d4:95:3e:3a:31:65:cb:b6:9c:f0:30:f5:65:bc:aa:19:5d:8b:f7:10:f2:15:f1:6d:4d:8c:58:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Resources.Reader.ni.pdb System.Resources.Reader.pdb

System.Resources.ResourceManager.dll

SHA256 6e7b884ac00a3e79c92c10c805cd2cc23bb3378cc7b1bc076f1897ccef2dd1f4
MD5 0c052098287128c0d69797a0deea9b92
SHA1 80aac9fcfa56abafffc0aa5c8de2f4c5e2208c46
SHA512 661d751c290f4aae13a0db5d2c5a96d83721f127e7b6c4b02e93e69755f1a92694869a137e5d8fbdab18fdee75c2e21a77189aa1b29ed6f17e54b2e0b31c175d
SSDEEP 192:J+WVt0WXNdfmxS+FYWULwu0Sc2HnhWgN7aQW1Ev7ZLrMhEqnajKsn5uiEw:IWVt0W9ZMSiWD/HRN7XjZjlGsn8w
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

72:54:61:ab:e4:49:fa:60:c3:bc:5b:9a:aa:a3:82:e8:2a:b8:f8:8e:06:28:df:88:a6:bc:ba:9b:9c:2e:6f:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Resources.ResourceManager.ni.pdb System.Resources.ResourceManager.pdb

System.Resources.Writer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4eceadcc10fe572d907f936865bffb65a5ce9dd695eecaed04b841fd43833b88
MD5 b2981fcbe48931fb96ae47867822e2c7
SHA1 fab0ec9fed214cfdab19523a4ae8cd574c3cdc23
SHA512 2f68dce52a4634a18d66b78790491b9a9cd47678145a4e111a8bd4dd8b5b0ca63e805ed8caaea3ee031b91675439cec02921dbe1b07a07d875a75f7264ba246e
SSDEEP 384:fvIToQKTFHRqVak0VzDhdFqmSj0YPuBSWebSW:fvIToTTFHRdv1qvNJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Caching.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 53827519463567379b65ac781b0c3088910eb62d4519069a0b138209ab840463
MD5 ba1e94ef700f2aa38291e841394f139b
SHA1 422f5514e43624f9d4292898a0d95166dcaf2889
SHA512 1c32be97b2b407ddad30b2f8c7d91518d77b28572e52313f72e4d3239383f12cb94759c23e3fa357eb4d1c7f242a47b67635f9f7d53ddc80a5d7cbeb98a1a23f
SSDEEP 1536:3jxDkeE3sMiZpRjp5TxySpovQIlZkUaVuH+usRr:l4eHMiZpRj/TxVpo4IlxaMH+umr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

82078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.CompilerServices.Unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f6a46a4502cf771bba406213098f464cca59a9f070bda2f00a2a8a872ef4a8bd
MD5 cb10eaee2fea04aefcd7f914ce4a1f13
SHA1 0c63af5b474ef723cc8d055191976896fe7560a1
SHA512 5dc2cafd65f79c744fa5ecd39116d2d02182a152c42735d1ceef28a3a08928fec5a48a106fa14a53e32a9c1c67295dcb529a67ac5189564fa07f0f99792b8dc5
SSDEEP 96:2HnzzY24ZxcE0+BBxvOuKDPbqDkRWgGhW:e01V9BxLURWgGhW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.CompilerServices.VisualC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21d5309f01d01903871637a6d863afdd51dd53a76df7f47b1a5efbc384013ccb
MD5 208b28354cc05259736ec9f28cbdffad
SHA1 259087f65f2f39ebe7c23cc8ef260c8eed5d4be2
SHA512 2d0ac0e5f4e93a61519208c86fe2ba971f0da6bfac1f60acde7ea17625ec0a981d3d1bdab2af8a58307ac91c1f9e790cdb717d6542eda443765d388f0a2ae6e3
SSDEEP 48:6xmSILXKd0w4GExkvf/UQUKVdJKGXBZLxObGKz+Iv3H1HuKqvf2DzDVQxSF8mZWH:yNfEiMKVdXWzxv3VHuzvuDzDF1Wsl8W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Extensions.dll

SHA256 8e96a55b3ce64abec33281a20e5f7c3ea151349f6f03edbf4b16bc65c8fcd966
MD5 1d71773c7f1d48ef4f97ff57d0384575
SHA1 4c3d7445d70e4b18f26147aef7987d9e3d198ecf
SHA512 bd560e9d14ee05be8ce56dd65826e5d9820abec0695ff6da937302f6f9ac33ddea912acdf42647a1e85209f54c01489d336e22042d2e668ac1a5b0361843ab6d
SSDEEP 3072:7R4/RerJ2UiL9ebKKKn3MJthc74vVJDS+FP1ihB8EkdqVCVvgYx:l2Sw1Znn3g5XSkykdOCBgY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:be:eb:1b:04:72:29:55:60:18:05:48:b5:91:2d:61:d1:cd:49:a6:43:85:20:93:10:32:47:0f:85:c9:57:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Extensions.ni.pdb System.Runtime.Extensions.pdb

System.Runtime.Handles.dll

SHA256 2bfc1675fcd00ea950832be8952438542029eccac3cea67fb03ef77f3aa0da8d
MD5 532eebd917fa3445788e9a01ac529976
SHA1 3b6f41d379b60725bd6df827c2d0897a808c90fa
SHA512 8c664a8afbf5d47970e2eb3052e05846ae6bc9b2d5521acc381ed566f69db8d47181cc7bcc9fa0c26248b2b020dba2fb93a2803769a1d36e398330959ad06d74
SSDEEP 192:7b4IWAWRWEFDWIxY+pErWULwu0Sc2HnhWgN7aQWQXjGH2vArqnajKsYc:oIWAWRW8CGYUEJD/HRN7nXSH24rlGsY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fe:8f:b7:db:93:02:b2:04:ad:62:46:45:85:c8:af:27:b3:51:6e:59:1f:79:45:92:28:5b:d9:6e:29:37:a0:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Handles.ni.pdb System.Runtime.Handles.pdb

System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e696c6b6b1481807b20026e95961ccaf90cc0709dc3c70fe0fefac39b2dd7bb0
MD5 3a0ba88fdeb98377cda57583aea3216b
SHA1 4ab89cb1a6b6e0749db5d035007a21df74e28813
SHA512 dd3f0885d3ed309f927333a64d822588d5748bcf95a329a0245893f8ee582f9cdefc6518d27a9bf5bdf3791659b7de1a6f471df2a5c10a85272f51b8c987002d
SSDEEP 192:O9g05Og2uPPUxRiAz4umIskFaxc3+piM9UWHgDW:o5xV3XO7mI6c3+iTWHgDW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.InteropServices.WindowsRuntime.dll

SHA256 29350f9855084ae8366da9211de0508e1f4ed8e95c50bd8bd56bd7a2f48f7260
MD5 57c755287d2bccce0022fd5c06cc7ac2
SHA1 2cc29117107a7fb38f32ce32b0f53a6e11e747b2
SHA512 5ba682297cdfdc7a92bbca4590caac9b85c6a9dd7399112d7ca183b35e1919bb5f65aefce7d3565c2b5134120d7805332c9081a3c4d6d58b7f3bea409e547f9c
SSDEEP 384:3W2BQWF7+FoVy+7fGD/HRN7QDos4lGsykG:vPGoVy8GDvQZ5j
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ca:36:06:0e:f0:1a:5e:da:80:f8:db:74:b8:1f:99:b1:02:99:15:da:28:75:5d:35:94:13:bf:79:6f:ad:10:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.InteropServices.WindowsRuntime.ni.pdb System.Runtime.InteropServices.WindowsRuntime.pdb

System.Runtime.InteropServices.dll

SHA256 2e6207dd28262b9ad4c37df330d6d2bc78b2127353633714d5c5371cd709f41b
MD5 57561f691d4114b9c2be57063afade38
SHA1 ad0669fbcd7deb8995a2a64a8a201ae29dc85166
SHA512 7b0bc17387fbc8ddee44ca57f748664483d29964e451cd3b7748d153c41c3f3988e5afdeec0c5a0a6e2f7f888ef88c0e4a5eb48bd99b216f4524d76b6dbd24da
SSDEEP 768:l3XO81UgyABoc9R1xnL+jxYNfsIMwDBQAYgMQPzYchuLgDv3:l3e81HyACcuXwDBQP4t0mv3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f4:d6:a9:a3:5e:dc:fd:03:b0:69:87:29:26:48:ac:96:bf:36:b8:15:84:a2:40:10:a8:b3:16:38:bd:74:82:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.InteropServices.ni.pdb System.Runtime.InteropServices.pdb

System.Runtime.Intrinsics.dll

SHA256 45e0356c427457edc342e5ea768c2c549707832df95dce7867ee144d6c606dfc
MD5 55b5253b608b99c9fc349befa0a98093
SHA1 7587ffa4d852cefa55cde261b5e850ecec48c6b8
SHA512 266c26565bcf6dddfd8a9da0bd5dc3283e4d893ae89fa2ccd0b64f7ffd0dd112b9fa230b4ffde995854503c63816859e112ba6334f471457d724cfecda622a39
SSDEEP 192:oDWmF8WzNXKL+bLJWULwu0Sc2HnhWgN7aQWGy3XEKup3JdqnajKs43:GWmF8WJCejD/HRN7u3X7aJdlGs43
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6a:bc:af:93:1b:d4:b4:ba:70:7d:65:32:37:2e:d7:65:5e:76:fa:65:ca:92:b8:f5:1e:dc:ba:0b:25:a2:f7:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Intrinsics.ni.pdb System.Runtime.Intrinsics.pdb

System.Runtime.Loader.dll

SHA256 dd29426bea2b62e9562d77680c134398b98b96f4e89d5956ea0116ce28ce9bb5
MD5 e727d44e66d0499c2808e3fa94fe540b
SHA1 48dfab43061d0202acb8f1b241635557fd37785f
SHA512 08b8eea12e1f69f58e0f1e3d19326c2bc4446f5f2d5cabf0ae61e7e4fbeaa4320b9c05331248a83415c0b229e236d0f7a9f7186bae46f52c3c52c413a08bacaf
SSDEEP 192:AKW52xWhrDXLxp+mEZQWULwu0Sc2HnhWgN7aQWs2cLrMhEqnajKsn5uNMs+:XW52xWVDXFpbEZuD/HRN732cjlGsnu+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4a:25:fb:19:c9:9a:9f:2e:84:fb:f1:36:24:67:fb:8d:0a:a8:aa:7c:17:3e:33:1d:bd:ed:5a:17:24:e9:98:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Loader.ni.pdb System.Runtime.Loader.pdb

System.Runtime.Numerics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 17ecadd1fa244a4659a0dc63d5d8ca1e4d2e0ffe7003f35d79c7918ac7183e8a
MD5 bf65c2664eca76b6a0749e743f706494
SHA1 a27c42a5f0003eac4301743763855e7a75a84a46
SHA512 2c0e25d1fffa44936e07bfc1937e1da41c7bf86b5292fc923dd2e3c421a9b0a2ec7668c160664862169f019d3d24e9acae48ab0a0ba455013912cefe87838ff8
SSDEEP 1536:9ymq/xtRguiMPUY86M+V/fklcw2Qj7UHIYKpV:9C6uiy+6M+Vnccwh7Uor
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Formatters.dll

SHA256 7d4cb47d227ee8353b9db798b6a876e7ed7f47b1e10d13c900f93c4075edbd1e
MD5 8f6eae5c8c3323e79463586646c283fb
SHA1 a64ef70194db0cee2a5cf4fba7a997747d577d96
SHA512 cea0166a33e24098e89411bef22379e8ed71fa589dacc8af7e2f0c5e252e7a74e45efeb999b250aeb772310e1c989897a5a6d74ea1d06db372d1647671d55add
SSDEEP 6144:vpxkk+J54F0rYX8O0QsvN+LLIOFfqIVPTAvPHJ:fk14KdN+LLIbiqPH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6c:dc:95:ea:3f:4b:dc:73:03:49:c7:fa:dd:96:84:39:ae:14:db:8c:e5:ee:9e:f2:9a:a1:e0:b7:e4:dd:4f:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Formatters.ni.pdb System.Runtime.Serialization.Formatters.pdb

System.Runtime.Serialization.Json.dll

SHA256 b6f77fef77146d8339ec91945c138de83f385fb1c97aebc22b58100b92783918
MD5 77ea61bf4933caf6149f0f207f8f0207
SHA1 37119fd85ef41481d389383543564fe395c14b0d
SHA512 96e3a7e9f2a07837bad4cf008e0035781184796b2ee71cf92f3d7b8eba5234aec4e77c85f1b05d4a4123c7352fdb6aac76d5c7270f245209621e1d34636bf727
SSDEEP 192:o1VWbuzdBuWou2gAYSPgxD+OCuWULwu0Sc2HnhWgN7acWKUgoqnajKs6eRS:GVWbuzdBuWT++DKAD/HRN7hUnlGs6e0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

65:43:47:d5:f9:fa:67:23:2c:91:e2:c0:d9:17:7e:8d:4f:fa:3f:f5:9a:ad:6e:f1:eb:77:2c:70:71:ae:af:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Json.ni.pdb System.Runtime.Serialization.Json.pdb

System.Runtime.Serialization.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 15d92328203247ea696119610c499b6398a7632759d30004fd0cc0e4b8fe4a99
MD5 c0523a17684bc4c2e0dc4cf9e391246b
SHA1 e93cc26ab6baf4418d948d29a5558a6ab9dbc0f4
SHA512 ac6412dd80f4090c733626f8385fef253a0efb955771f8ee250ca77d0864c1510073ddb8bad82db8324b35a3981e27461c6f0cc22b946fcd9cabd5085d5accfb
SSDEEP 192:PlUBfukRLycfxxsy7z+9B+N8VkOzCfCkNFoNkHHDaZxMPVyYQ3GFErHWFIdJBcW:3ALyeKh9BnkO2akXJHHDwMq7HWFIdJBV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Xml.dll

SHA256 ec4fa320dbd9555f71a01628efa819547f62f3f753648fc4462c2eabeae6e4ca
MD5 f8f1ab207bde27493bdf4d188f526c72
SHA1 bed23968cc25eeacfec6e7ddd493c500191f56b3
SHA512 b080fe84746d7d3293c3fbca2843c6515024b1a9b20e25db54785cf9fe6fed18ba421cd227bc62e9de197f8adb7b167387d87d5dcb6822a1d71d06ea133844e8
SSDEEP 384:YMWsB0BBXWWRlmI8NVY57D/HRN7sJ/AlGsuC8:YieBBpRlmI8NVq7DvY/xh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b7:03:b4:ad:19:64:78:29:4c:e4:2e:71:de:64:a5:63:d1:72:61:e0:25:70:5d:21:ae:e1:b9:49:e3:78:14:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Xml.ni.pdb System.Runtime.Serialization.Xml.pdb

System.Runtime.Serialization.dll

SHA256 215bdb2c852991981a2e4a65aee32346013eb7eee959cd9c8ba2f9adaad47e4b
MD5 1965fca734294311e234a8c21cf6063d
SHA1 f1ae7451bdd0f011a04c5ff4fe6629e15ab2ffe2
SHA512 b05f3c97712d3d697a73ab36cf1d245a947e118ba21195f40be599d9edd2e458ae92f3e318dcfa7ecbdb9aefd3e9dd9e154f9967295092f720abaeb908a7a48e
SSDEEP 384:XLWgMw4BAWnDNDj8NA2eD/HRN7dDhX7aJdlGs4S:XPz4BpDNDj8NzeDvdN7aJGQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

62:f9:7c:54:a0:fe:06:2c:f3:1c:4e:4f:43:5a:30:df:dc:ef:79:c3:dd:0c:7a:b3:6e:b8:82:e3:8d:cb:5c:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.ni.pdb System.Runtime.Serialization.pdb

System.Runtime.WindowsRuntime.UI.Xaml.dll

SHA256 7c7898a001b4066ab18f6e0e8cef9a9304bd3268d892a661cc273bb77ae1fc87
MD5 499b8d53b551eaab422fd36b4d104ca3
SHA1 df6c184ac8f8e971aeae7d00c74b746534314a5e
SHA512 89588a406175ea7398b19cc1c30658591a24970ea2f94b2398e7fc9d583e6ba445bd5fc52dde41957e1cc3a8f60e7cd4ec2e923739215ccabda30f56045c904a
SSDEEP 1536:lT7kr3y4KvS8oXRH9X2eh1Hnxpo/8qJm6t5ZvuB:lTgzzKvSVXzdB7K3Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4d:9d:72:99:47:eb:d2:36:b9:9f:27:c2:1c:40:64:1f:f8:f2:3e:4d:b8:be:58:19:83:35:b3:06:0e:01:59:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.WindowsRuntime.UI.Xaml.ni.pdb System.Runtime.WindowsRuntime.UI.Xaml.pdb

System.Runtime.WindowsRuntime.dll

SHA256 dd1c73c6bcbaf9c38c5c48a256fb65ea063552061a1beded4970f3fcab2b4512
MD5 9cad66d76a31cf3890a40eefd483fad9
SHA1 4e3ed3cc676ec241c8aaad6bb92b728e5a794966
SHA512 4903693291ddbe1be843d6145658d9f81adde513c2b616add26757c54b68abac2b3e4ba9e2b1004b4d4903dee11c714fb7db84f3eb2b0f27401ad53b34edd1fc
SSDEEP 6144:9f6YoWGxeGMc2fDu2WFLz7mXSaR7KlTOZPwnPqP7fPi+ubbrze2vQQZm5tM9:JW2y5THrzCW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4f:fb:3e:80:ae:be:53:59:a2:0d:de:ad:a1:5a:05:80:ac:cc:d2:a7:76:3d:02:50:b7:35:65:7d:16:c3:1e:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.WindowsRuntime.ni.pdb /_/artifacts/obj/System.Runtime.WindowsRuntime/netcoreapp-Windows_NT-Release/System.Runtime.WindowsRuntime.pdb

System.Runtime.dll

SHA256 6229221c2e66f3afca4bb9e6c17bf882763f06052eaddf8ee5901bfd36fff34d
MD5 80f4c8ceeb586b9196cfb1752963f208
SHA1 33acef8b7589299919f3fb70af552bf8e100cf5d
SHA512 725be8ef79de7cb1ae07932e5764b177a4088dd1fdbc10870bae721c2055f47c4657d2b9aa419db9495295498ad8f01dc2850e7d69b9741d22e2effae4488bd4
SSDEEP 768:+x5GYe544b916CVbYLNn9vYAv50o22/UR6ajDvzy5:+x5GYe544b91ifZ0or8R6Yvzq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6d:3d:05:19:19:f4:7a:54:71:69:b2:1c:fd:51:5c:34:7d:52:b9:19:5a:24:27:e3:38:be:94:7e:d3:f5:1c:df

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.ni.pdb System.Runtime.pdb

System.Security.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1ce6f6d973e21cee1e783c733a3a3e8ea805557817dc91e4c345bb3a37e475da
MD5 351218eb5c6deb7a3a965bd834542430
SHA1 f159cee38ddbc638a053c47ca08ecfa45ea27ed5
SHA512 c42a0c4120a1a0a0b91d5b3da90a2fdc2a3272d0251072ef19cf3e4322242bfee35a3220f10e1473f57afd0a2ed2465f69d6d26f9351eb506a9109f2f71d125d
SSDEEP 768:XSCeWMIdeSynI5v4jganXhhUESHbCupCupsWBkyDR5yzXbREKucEyYvAu7tiayOF:zOSy+Og8nUvpB7KzoAuEWHyQ+cKq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

84222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Claims.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 030539a9978802c498440f5a7a7996147242b566daaf1f97be4bc5f8699a955d
MD5 e1b75a5a6a57dca38eaefd8163293ee5
SHA1 0e0a657ae201e2e2685db318baa5a3bab0fdc467
SHA512 8b9896c93d411078d9bd2720f0774ec8619e9263ba4f03d386d67cc101d098ce29a38ec4ed2d74a0e27fafdbaf1738aa872fb0ac7728db15c2d001e08f4a099e
SSDEEP 768:DQ9wLspB+iMgvW4Tsiozu7bSw7RAxl3OQwQ7rzUU3q2bP61o:DQ9wc+DgvW4TsiozgbhRAXOQwQ7rzUU1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ff27290fd3cbc48c0085e5cacba52f068421592a1ff5a6f42b6a7e227b9b5534
MD5 87572462950b80ae76e43ff5ba0ecda6
SHA1 5f615549cf3eae114a92206a73f9f9654edc76f3
SHA512 91dd4e2bcebecbf6ece9fbb5833d274b84fa5fcfb8fcb7471cabdbcc8ad47c42c554b14f86fe228ef3ecb9140861c884ead06bfedbcfcefc9ee6640c603a9f8d
SSDEEP 3072:xSfXxEah7CQCE16utmq1j60kXSAKXCiqwg0yf9DxnEhG4kOuZd8cYIhpp6lqOEc:mKmHmq/AYHqwgVDxXQ+pO193
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

230814

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Cng.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fd134e6c857ad6738e6572828e110be11d04ec30294147039fa905593b019400
MD5 c206c1ca46052dbe5f1f108c580552a1
SHA1 5940ed070f86bd95289b92f14677d7e768dee496
SHA512 c9b4f4838a96f2c38e894487bd6e7eddff8ffffd8d6b36c4ee7c8d2f0a0a89ccd82f81963de6eac3e8e2d8e22158e5b1a80db27a2221d6ac46852054d321be44
SSDEEP 3072:ChxnwABgSgQguyQhk5N3BFGixWgXhG4kOuZGTc/py7pK98co+a:Chxna83mfxXcpWpm3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

155230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Csp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9df5873ca42586c3504a05cd2174e90467b8f126b48e8e633fcc4db5e5ab17b2
MD5 9ecf3c766b2c53e4e60cd1932de40b5c
SHA1 b55cb108338d3fdb593181aff05f81d758606188
SHA512 eba3c307bcba0c2477f04588e709a138a4d45f2a75c4104944cee31c4240bf8be18860f79555b39f124fbf4d99cf27565c70c8048c6b38a6e2ec9d0fd85fdf85
SSDEEP 1536:0CJ4Re75Ko5/1UUjDH011xHQgWRRRYLReUUQ3WO0lhtTFkx:xJTU+UUHH0v9rUQ3WzhtTFq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

72526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d721ea781ac4ab419f90e22ed739c02729e954b7ee38116a60d7ca4831405f4
MD5 0d0fe64e00df619c178e176983f422f0
SHA1 218fb94999a49ecdedfd088ee444c765a4b1e8df
SHA512 cb83ab94be5c03a16945057e5d485f9dfbd5127fa7865e74883be7edeafbdf417a93c64a958d37ea85fc7f8b6c5fc2c7b61b0faecf60b0d5d1c35878fb19cd5d
SSDEEP 768:tuSboZ+0NaJDr68yQ7926vP6r+xcsvTlokSD:TbS+waJf6E92s6YcKlo9D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.OpenSsl.dll

SHA256 8ab886bfdfc91f4ce460df3e57abcb5fcf57b9093813311a4e4f443b1cf3c147
MD5 1464c6294368e56c5b49e763515d0dc0
SHA1 ad2a55c80ae6c8ae8807e48918aabc10da488b5e
SHA512 708e5004f61b69442630e462db3b7694cb104f8f9056424d13234cd5a57b06de17afc60adc534070b3a5958947a7b5c4888dcffff0d9578aae2368ba0707d48c
SSDEEP 384:oji9WAmQijWWAIxNfHiRQGVMTsPQ7vz8zlPKU4WagQqIfLDUBOjSmDD/HRN7RHsz:ojdEI6RQGagQqELDUBOucDvRM5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a6:b9:52:4a:b7:c6:a6:d4:39:d2:ce:2b:97:46:d8:71:d8:08:63:0a:e1:31:0c:96:67:7f:04:da:e1:94:05:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.OpenSsl.ni.pdb System.Security.Cryptography.OpenSsl.pdb

System.Security.Cryptography.Pkcs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a264738f803951633f480516d4ec3bd91af5caa4da682592cd8912dc2694211
MD5 14a8238f1f26689fbed25c725a39d1d2
SHA1 ed02d07d6ff65293fb0facb8b875970641c9bccc
SHA512 6ef89b1f01307e894dc63036c93c85fc4025f226efc42fd20637c1b237126661eabd79df882f177595e9ff4fa01886cb3846f9e4290d238e79b838a2bedb47fb
SSDEEP 6144:sKDJrX4NXwVVLEBL/AEm8qwF/FWnU5QEgETM2Y2FYCRqA96anyxlMWcAGWDUm7:FNrh0E4yxncA59
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

282974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ab6456af4d9c01c20ddc59487cfe5139802c243659d9f42748b60a5632df42f3
MD5 c8cddd0d08703dee6968d1151fc14262
SHA1 50af164ff9ea31e34dc5edde4571e092bf7d8bc2
SHA512 0ddf3512947c5313cdffda30147571f5450945c61271fec9a8049f7e206ef1e1f20996fc8d2cc658787d9e85b033a680d8f4b56bf9906b5cda8b79e12e0c57b4
SSDEEP 768:aSMr7aKPGtCReuveqVyetbwyL+EgbEA050FKdKzXbv9:Or7aKPGtiyehL+Pb+50FCKF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.ProtectedData.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9bbe0341f7641702c95279907dee49cefe72996c2590425fd83504427a09bb2f
MD5 2e281c2b911edbb407c7fa84d178d8ff
SHA1 6f415bfd72204ece72249ce75521cd22caa87b68
SHA512 d919c2dfc59debecbf3ad79dfe5800c28cdcbbb4f4665b752e0c289d2db45a03e57f4e9b677495a5036e0e49d858e0fc684717fdae62ce64ac550cad718b2b8d
SSDEEP 384:u1RGUsD+TLS9O9SwYnq0EQBNqPWAgZ6jEW:u3H/Z9j0q05Y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 335c97ae26a2faea7448f96cc51dc153d1a863d65e51b65d6b971c375c694194
MD5 6957a23efda449b2e1e790bf5babeeda
SHA1 c68608473f6e5c521249d940f6040c6568d0af72
SHA512 08e393d1419cce6fbcd6ea8758a9653b3f1caba476380f25308ef50820d03ce681326f01b77188f59740b51feb4419985c81213d4ae0f836f62685dcbf2d480b
SSDEEP 3072:HhxfjoxQMMyEW6+zGGoNWJh0YIEnjvrqaFpoVrZvZeCPVBufo8SrOzRkOuZ3U7rV:HT7oxQ0EW6+0Q08rqavrCPjufiU7rEZ7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

185854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Xml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d7bbf02bb32fb861f55161f34f0aed5d883038ab3c2f60ee8774681a1c25791f
MD5 a933a6f9371a703684d430fe65394b46
SHA1 b8d88a512638f28db7e8c176b2046ac7eb18d031
SHA512 3e1254e7e29edb8e5466136fc24ad13ee8a370473806c99f70325a3e4a64e9f82ebf0153487138950dc35da6522ff16f13aeee94621071cfd70580a0dba4c322
SSDEEP 3072:VrHIx+bUNxNkRUu2Na/S5Ds8trq6KF2IDFSKZI5sAF93iUeetKQRvXDzVsSOfHZ3:ZIf/+UQ/+RsAF93feeWuE5d8bO5p+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

156718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Permissions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78835b8707b4cd259036c433412b1686acfdd858e39f003cc7f881bdf213f952
MD5 8777398255b941a954d48ecf8b78e2ee
SHA1 8378428d9979aab355c91e768a66cf927a60b51a
SHA512 c75be5d2b0918eded3b83c6d0de1f9fb6cfc80b9048426e87baf381133a782c7cc2526c3cef1d26c5ce28cb4395519906de558f60ad3363078125cb8e411f75e
SSDEEP 1536:16fkxbt06VjqfCwDGV4B27OXWBiha+F6Xn:n7gCtV4B2ymBiha+F6X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

84686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Principal.Windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 16c10189093126ee1a2d8433933ea8bc3388dbeae1dbc37e7e1041bfb1c5779c
MD5 4543c863c6873e8dc5c06e98a216a618
SHA1 cce8ce05047b31467f309d2abb83eec9334c6bf5
SHA512 404f581e1bda6f42ccd64c478184a01aaa4e552982707b9a7971d5db517260cb9ade019e09d2e46ba3079d1c4aa8afae0fc5ae98d2d7103645776f7c04de9055
SSDEEP 1536:3S8Pfa0roJWDggldpxv1MVx9ha+6mMqu:3S8PS+1Xdbv16RMqu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

66030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Principal.dll

SHA256 fb9009bf2713d011b0d39444065f035f5321d66c8a3789481ef4a7045b644a3e
MD5 c062c59e1ebac28ddbda2c74cccee988
SHA1 66ce3754a2dbb9183a8a3018de4f08026a850c41
SHA512 c9d5baba5ab041115442fdc73a62276aa25e6b0c920944677e043431cc3811cf623cd4c1faaecb23f7cd25189a32f881fcd54c4774cc372f85a0e1b65c46d5f7
SSDEEP 192:WrjWVUpIW8GwBcxE+qCWULwu0Sc2HnhWgN7aQWrH2vArqnajKsYdR+D:oWipIWbJEP0D/HRN7EH24rlGsY/+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0f:1e:78:24:8c:39:cf:cd:c3:eb:68:10:d6:81:fa:99:89:50:e8:9b:01:95:e6:ad:47:6e:4c:4e:66:77:d9:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Principal.ni.pdb System.Security.Principal.pdb

System.Security.SecureString.dll

SHA256 88686145c2cc9e018a97f2cb9a32292527314cdde571461c95f1ba3cfb2e8d02
MD5 59126129f1571f8fa803915178ce132e
SHA1 951ef0d32a7af2a1d572dafd96934a4377dc1e64
SHA512 413524c988ed6d77fa98f4c32128ddadd4a733b8602775c3ff9d659e95fca9c0c06c0d3e730ef692e2b34a1c3ca0299e1c3f02b71478416a8b8dffe3e7d28a19
SSDEEP 192:+eW1hwWR8/L4xX+vz1WULwu0Sc2HnhWgN7acWIH2vArqnajKsY6Ik:pW1hwWDXsfD/HRN75H24rlGsYW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bc:e6:b1:bc:5b:8c:83:24:e7:a4:06:a1:b9:2a:e1:f3:95:28:16:01:1f:21:0a:4b:23:3a:fe:81:2e:79:29:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.SecureString.ni.pdb System.Security.SecureString.pdb

System.Security.dll

SHA256 6669f0f5deb90e9899a34393aa2462f1901695b5b238739648261cd714a517e2
MD5 2aae8067788a4ad624a18cb1feea3810
SHA1 b2ad602046f0f6e1dce875c40fc806f3f692722d
SHA512 19fb3408cad9f0a9530cdbf9ad46f4be66dd92fd68bb248c3c4c653d7f4a4edd4dd4c27f695aad863aaec03767c7c0433f1ab195fe34457eb03c4dfc6d2b8631
SSDEEP 192:Yd3WsdEWxVXHku3jDvupZFiVyJEeoxh0vxU+8FCgWULwu0Sc2HnhWgN7aQWrs4pq:O3WsdEWXUWh0ZUps+D/HRN7os4lGsyv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

43:65:cc:90:77:2f:06:45:0c:a0:98:41:62:48:49:00:f1:a8:e6:a5:ce:61:7a:fd:d2:70:26:d5:c2:02:dd:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.ni.pdb System.Security.pdb

System.ServiceModel.Duplex.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78ac27f0813479dca9092c1160e699a22d3e4a322448d0efcf68ca1762a37730
MD5 118ee20f1160428ec506f9fe57c80225
SHA1 69649b52167fadf1c94005fa8f6d9ae9f0a84962
SHA512 8efbe1fd607236bc9d9e4ba05cde426e6b49c5fe73267b018a439db7824bf24077fbb2f68b9f1a03386f0e7b2f1f4031c52e95f7ee9d2587b95254ac5fed2648
SSDEEP 48:6zZCK4FZAcedQiwcw0+IvvWqwWk2zDmDYDCJ851ZWx0kK/mh05WxfG:QiFZvexvvamDmDYmMW5zOW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e5ee987c419900517173a5ce5b4215396faa8fbcad7c5d45a7699dfc6fb8f174
MD5 3708250f24df059d4814a560aa348a25
SHA1 fd9da7f8cc293513e7add9e7dd62ef6ba9074a03
SHA512 430567a2603a96a9d68094f93abcc7bb75ec0363b46d13e045c32858b465bcb39471d0967dc800839546d4932e8173a85c02b53809de5e008b127389acad5523
SSDEEP 48:6Odu829ordYliXlbdjmiDpDBsgn+Ivddk2zDmDYDFQ0LZWHPKUTe5WxfG:F29kdB19pFxvkmDmDYHWvHT+W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.NetTcp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 093704aded9db781a65a234b7e8fbff649e112599056115ae5120b5e2b194559
MD5 41cedc634a584887a57ca22be8b29b3f
SHA1 eb1c0c22cd6b447c6814f24f5895a3c52a2be93e
SHA512 57f5ef0a95b2e0fcf4cd29be381628b29f4b52b430ad4b573c2241d61124df81cba5dd76e2c4ad16a59c6897025ffba63aea0625f36cab8d1ba971a33bca1066
SSDEEP 48:6WmcGlj0HGPML9uiwbdaXmiyBy9wBTUtJH+IvvWqHk2zDmDYDaJ8MQZWxBhKGP0H:xSteQ89GEXazt0HxvvOmDmDYekWRrWW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9d10f481254515208b78209309db31a804f55c742a45aa843fde4e7ed3e02341
MD5 8757fa6120b249a4dabf41f1e86c1a88
SHA1 090aeb4e0e18393df97a6daf6bb2ea7c4e512349
SHA512 69c515ced32a8539907523e63372fcbeaee1433fcf6a2578f894bf61c474920498951f3e60cf3e7af5a5044edf3b926a20d3cd7062f447e4a41d326a8bb30efc
SSDEEP 192:bInSbiz8GdMhb+MSpDosKB630mkj/LBemSZfyxdZQWvhEW:MSbiE+3pUsKmCtemLdZQWvhEW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Security.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dba1d155da566afc2bf4d131f47f6e770374b7f2d5e6679e978cf5ee099bb73b
MD5 99a41bbee6e343283929baf92b1eddac
SHA1 1e174d3b47efabbd683cc6577a8ed6e77d42bfbe
SHA512 41064b29dbdc320a4b7f53d39dacc8faa864059a6dd114ede610427ac7aa2c73a15e7bf11193d6d026bf3ff0dc237e410001c8c048f5899ca8baf9b570dc99c4
SSDEEP 192:v/KM3MAmvXbTFeFF8A8ei6DRb6xamW1NgW:v/cJGF8A89/amW1NgW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Syndication.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 48d6d299813cad6fece7bfa7a2674404750be32dfa541cabacb1b9502b7fa11c
MD5 42aa1719a875f869c067ada18f516934
SHA1 4e3724a54926395370bbde2bc9d0363c23dfe9b1
SHA512 1c1df8fd476d513ce019e5ffb0a872cf420e0668e547d276b87d3bcc8b997d07958b0301d5bb575e59e2b279c78d45426b11d6387f9158c93cc81f6dbdfd3e32
SSDEEP 1536:ec269zaeQhBxhgBtYkc9d9Cnic1zALtHijSQqi25H8wy4ze:lp9zvMJVLlCic6LtH2F9Ye
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

115262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Web.dll

SHA256 6a5aa3b1d19098b1ad8fb7d666b1c2b179c0f64b22c1d6be59511952d47e7b23
MD5 4f3161394055632620fcb5e2a1b0096b
SHA1 0e086828f6574e6d51394a7e63e9945fc23f43a0
SHA512 429318ba8a2bcd74a6e5fa15f266ef24023ead05106e6428715c567d964627d3a5e3cc302c75a0c6808e00e0cb1ea03e9fc7bad7b630b6dabbab591d3827b3a1
SSDEEP 192:QbjWGl/uWQ7Q/m+kvWULwu0Sc2HnhWgN7aQWBXgoqnajKs6a1:qWy/uWIQ+jdD/HRN7wXnlGs6a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d2:f3:52:76:d8:e1:b5:6a:5b:a7:93:88:c0:82:e0:87:38:6c:5e:09:dc:f6:72:fb:51:17:7e:65:be:89:24:a0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Web.ni.pdb System.ServiceModel.Web.pdb

System.ServiceModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ddfc838ba2ff3f30118a557f47a9fa8483a36e0f639e016715bda0474008712
MD5 faabbb1dded66aac765f0e75e816e1a7
SHA1 25641af23c12c660853315a0244f2186e92cd1c3
SHA512 3a71ce89c17a5cdaa41d761f179eaef8ad62cc3dd74e07a1eff21a64fd4929c9e02c511de046397c02d91449e4ef35edea8da571d4c91d1834ad8d0e5d1e6a5e
SSDEEP 96:YYApLV9qWUVobHI6GsQdJwaGfVl6EffsfJ4fYYQqJiNQpmDmDY2WsV4W:fA30WUybHIjsyjy63IQqJiNQp9WsV4W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceProcess.ServiceController.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d0afad6d61e2122d5325474cdfdab4eed6a704c1a3250b2d47d4a0d43d0a76e4
MD5 a140c23e6d85666549dd11c8cc709cc7
SHA1 b3e07a9b78dd14e2ebe776a86e992291560c91ab
SHA512 f9d88669a9bb36d3477f4ccc241763fbc24808e4611961eb1e5dd56bee550d269c4c11aaebcfaded5ee61a0418e111ff2e8308c00dd8f0af5852db106ec9c89d
SSDEEP 768:C7I92ID1ClTw0zGiz44lkxK2sK69Gry+cRb/6OOD7biXr:P9p8SAnixSK6Jb/6VD7biXr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

55566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceProcess.dll

SHA256 7da535490185fd67f341f3f3d88fc975b70bf927ae8ef4f0f6e4d1d1811a909f
MD5 e05b479fe04002f48d806c9b46882cfc
SHA1 f6fa2e1f89884822c8ea5ebae427052f8b674b3b
SHA512 d56abcfe13a9cab396c01bb507a65c8949f5f18036a18335cddc714f948528bdae3f93fd58b3c67b3fcb923bf90791478ef68346b676ae0c7874e48c2c7fa709
SSDEEP 192:Kc5pWniHlpCWEKzAxy+6wYGWULwu0Sc2HnhWgN7aQWNeLhMzqnajKsIh1Wf:RpWniHlpCWfiycYYD/HRN7seVslGsIO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

71:0a:e5:8a:31:8b:20:1a:61:cc:62:d6:59:46:8b:4e:f1:c6:05:06:84:f4:07:50:54:66:f4:e5:a9:5f:0e:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceProcess.ni.pdb System.ServiceProcess.pdb

System.Text.Encoding.CodePages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f9c93c111d43f7186baf611fba434e1eeea098c3021d354ac69970aef332bce0
MD5 61e0df9ccac513069789960137e2fe50
SHA1 e9853fccaf251e7e996f59ed0cf45c8980ced3f2
SHA512 6ec5974dda5c99bbbe208bf0d96c449b46c3b3f5b7a68c42656159d329eacedbaa65293a1db6326df42a269df29070e3c88ae6b55f83b1f221a37d15553bc1a3
SSDEEP 12288:MkMzb7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rV5:Mnz9km6k/IwRYbiBeKGCa5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

731646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encoding.Extensions.dll

SHA256 f1b55fc3b7b483b37a86541989d1ed4bbdfe817d0c10383727c19bc56efea4ab
MD5 42dd58c9e859945c932b4362b53b5876
SHA1 e4dec1d5ae4cda32378c42840e220319295ccba2
SHA512 0608165fd8accccca7be43b203d5d5babfa96ad40b9f33df6581386ba8b668a49d0dd09e26bd765c9c42e5b1f5d72db64e662f607afe592b1ef57a9b227fb736
SSDEEP 192:Q0PW6P+WqCGn8txY+RQWULwu0Sc2HnhWgN7acW+qI4EHsqnajKsYDoW:QOW6P+WkAY8uD/HRN7B74UslGsYDoW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

39:25:51:03:a2:d4:8b:c4:f5:e2:49:57:e3:86:92:6b:78:4c:fb:19:f5:f7:e4:f9:94:8b:83:0e:c4:77:5e:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encoding.Extensions.ni.pdb System.Text.Encoding.Extensions.pdb

System.Text.Encoding.dll

SHA256 bf6b423e0d07180632f87f34447a3bdb4d5c867551644c82895055dfa004b34a
MD5 0bbfc7ecd32b766368bfcc1215a3b845
SHA1 29ab90c86ea2e419564cf951253fae3a14070718
SHA512 4f11116a0456dee529ea69029893f3e2f9aabc7b011f76081434b87f97d5fbb5f88ee4a33febbc68650e5a4b7aff8d9ea3f67e0485c62f480423d7cf6e28ee6e
SSDEEP 384:6Wfz6WcboZmD/HRN7TwJ/AlGsuCuZTknN:XAb6mDv4/xxEN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

90:5d:27:aa:c8:b8:a9:69:39:04:ff:52:39:e9:98:9f:a6:28:30:6d:98:02:f2:fa:97:9b:6b:15:cb:e0:dc:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encoding.ni.pdb System.Text.Encoding.pdb

System.Text.Encodings.Web.dll

SHA256 b5be0ad8ecfa6b50c78c4691ad7cb7856593faea534793f980f56d0be397673c
MD5 e0c801d688f675e385119aff6e33d4de
SHA1 6cf5498c4aa98e691afeca65fa9a4c4e1e65779c
SHA512 7fae822e1b4f66399920a6b52ee79bb99cebb0147c38fa1fb1d7a200ed48a10c9af8cd6c23fe4a1dee7e6d540dc79dbf53babbad8647a08d3e50c1d29647797d
SSDEEP 1536:xsANf+9ecUx1HmrxYtr3C6C32SY9LGJ+rkyEb3kamFiDx48JPFK4Nvy:xsacUxdyx2bCx32L9CXyEb3kamFiD2q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2c:13:06:8c:74:a7:d1:8f:2d:a0:c5:c7:eb:90:4e:08:be:0c:24:90:86:1b:0e:4d:74:68:94:87:b7:4e:01:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encodings.Web.ni.pdb System.Text.Encodings.Web.pdb

System.Text.Json.dll

SHA256 eef31b114e74ee4fb3064fa7a9503a227f8ef1bb8ed98e80a7f17ed69af4625f
MD5 2c73dc9649804e8f9398ddaff42f856e
SHA1 a33671950b92be92c5f9881417b57fa23783a23b
SHA512 537f9009bebae3c8410439d620a3e30233c68cf19ff15ba9ad60c32cdd2bce1ab55f1334b1cacbdbe4a47b14e21b95d9526f6cf69e101f660e514eafe328014b
SSDEEP 12288:OPVnWkKCGEaJlUySNkpWHqup6McVsBf0iGRhfvcdup4qwDcpo1lRVYSJpObcDN0E:OPUk2Zzfvq1lRVYSJpObcDA6uuXdxKHH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

05:d5:c9:a4:3e:50:9f:4d:3f:f7:18:96:43:73:77:85:e1:2b:fb:08:9f:94:d7:da:9f:5a:35:16:f3:87:09:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Json.ni.pdb System.Text.Json.pdb

System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ae181d511f92a50253e1c8f54765c2b6facb5c6c27261aac035574aa49a0105c
MD5 7b52405e65103459f6cc168942a665fc
SHA1 bd0b53883ab7cb08d78223c45792ef0e59913f54
SHA512 2e07d6291e75f5f47b792a5b43ab6970cdeb128535fe608a33dfc1f6366aab2f57b3893d5e384635c6d23b950b099f694dd53f0526c5d01e3922be0fc2a49ccd
SSDEEP 1536:hw9A2ayyLmGHrlTtX8+uXRbXSUkCse0RWVgeUw9YsZ50MXS3pAZTyJLWubDaPTuT:hctnn2d6v550MC3iZ+HbWLuT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

142382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3dbc176f20cb9dcd3a66c4d45d7b473d7ddf5945fecc5b3a824e511f4296563d
MD5 6d46a78535c08c1cc0b2bb1743f2e978
SHA1 2b6dcec3e8f8db4a61ea6c388853220ad5ebb445
SHA512 3a08b5cf784d9b1e927d68096a8e961744b3d48d845ed757e4c5c786f6e932d124470d8f56c62ba75b74cceae77f4239f0d302d0c0bf9f89bf17298d9e96cc6a
SSDEEP 384:/fMqUkBijXUNf5Rf5Rf5b99exHy8qqO6YXWJWArpW:/fn0Q59j3e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Channels.dll

SHA256 9b9776f6879be7703a2048513c9e0bd9d5d821090282fde42b3795446c2ff9e8
MD5 815e2e69ee0d948b3d564d827f3f0bfc
SHA1 5ddf1f4475097ff86b886f3c9a803979d17a274c
SHA512 e25fc9bee8c1c18562afcd5bdd0a8390de4c3be09b8536ea22e502053faf6fba8a150a7f83def7648d967b7d75964f32a8b2c1765e082d745cf569f204dab12c
SSDEEP 3072:X/vmC4BFA1dzKA4LChe7W5TehDq/wyj4lM:im3QCqW5eh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a3:70:66:45:e5:67:3c:98:49:cb:00:0c:b9:f8:ec:4a:b1:12:65:08:3e:35:d5:61:86:2c:3c:4f:29:73:7b:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Channels.ni.pdb System.Threading.Channels.pdb

System.Threading.Overlapped.dll

SHA256 c491da84461aa472cadd795070218fb88a38e8d636289dccac5e7181a2c30fe9
MD5 7fcc76b2c0bb358b28567f0ee73c5779
SHA1 b8d6c313c9ab1fe087aa78327c371cefcf6d2d28
SHA512 968f536278225fd9746de2a3d81b7ca320ac4d50dba984da3f5f9bcaf4b6438eb8a5f93644da029d31eaaa734f89b63cf2a0dde821fc77696bcf971d877e9a4a
SSDEEP 384:RtWcRAW1HiH+zHgVqHVm7s9HSHJTHQD/HRN7XnlGs6Y8:RbIVQ2sDvk08
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c3:0d:b6:ed:94:34:a6:79:15:85:cd:11:b3:5e:6b:2f:61:ed:e9:d4:29:f8:c9:83:4f:02:9f:88:4d:01:9d:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Overlapped.ni.pdb System.Threading.Overlapped.pdb

System.Threading.Tasks.Dataflow.dll

SHA256 0b4464e44c2c1cad8e9b8e0cd7e2cc30d3a1b2804bc7447243c27bb4c1187a7d
MD5 809e4c2d1873ab60586bcde6f24e5f2a
SHA1 967e090c5760b8ffb21c1eb1404b9030bed7433c
SHA512 ae85d7451d90ab367b0100ca681dee9f3554eefe42f5b4e7a250e0f6c0dfb39018468a0650944111327a81bb30abf61430b68c30c01a5b56ca0b588991e82c3b
SSDEEP 6144:slyV+a0ZJ2q5BLeNp/1x1tBB1x12LAVYasoq4mQb9y+Z1d+NNBWfxH+VR:rV+a0r2q5BLwoU3q4mQb9yY1mWfxe/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

61:d7:da:fc:c0:40:d7:dc:76:cd:dd:0c:2b:29:89:db:1a:70:c6:8f:ec:c6:66:64:a1:81:ad:c7:f8:61:3e:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.Dataflow.ni.pdb System.Threading.Tasks.Dataflow.pdb

System.Threading.Tasks.Extensions.dll

SHA256 3f425ba95d7ee932a3b2002ea748294a96cd9aa54d35c79c224c71eb75c6ddc0
MD5 6f5612fe217952ea416ecd55a8115d59
SHA1 60b69966a7ebf002af523d47748198b694d0d3bf
SHA512 6a67b2676277038c0b68c4ca3b0e19f384bd917562d0d6ab17f345b7524b1165cc9942ebdef6e432f759e003ac140bd4b1592f4e0a7b4b2cbe57eebbb4795068
SSDEEP 384:BWSRQWy0530k1ncm+4lDCeiTaD/HRN7Ax4UslGsY4:lfqz4AuDvK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

53:ad:54:f4:ac:c2:cb:32:2e:da:54:10:5f:ea:01:a2:1b:b5:b0:a0:d1:96:22:28:81:fd:46:a8:92:76:04:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.Extensions.ni.pdb System.Threading.Tasks.Extensions.pdb

System.Threading.Tasks.Parallel.dll

SHA256 b751db82d8bbac0a2cc3a2ab36a747d1cccd037c0f7feca35d7fcc423856d862
MD5 1022c884cca50544529f5c1985d049d0
SHA1 ef6ee28b0601922768265a07abf005dc7562b812
SHA512 cd0d53e792cb45ae3ff81537eb678b759e0bf1e08dcde5e38922cc8c00e77975cde9614a174928a352096abdb640ee0317e6745d2c852af800b12397c36ff10c
SSDEEP 3072:1hUvcVnLdOg9jBtJGa3rZNTYqUko0OE4P:zb3rZl7UkoSe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:97:54:aa:45:5e:a8:05:49:84:6f:85:14:17:e7:48:98:8b:7c:07:81:6d:0c:e9:84:06:80:b3:ad:a4:6c:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.Parallel.ni.pdb System.Threading.Tasks.Parallel.pdb

System.Threading.Tasks.dll

SHA256 a7dbe5337e5bf3c5b6c2ea0408b373c5c4278870a3469d84df6099d6df55cecc
MD5 64a581c5fd4839f5e032335c693693ae
SHA1 dfbc7761ed1efbf7388a415600ae31409f482280
SHA512 01f60953882a2dad0411dc3c86c5bc115eee4968e5f32f5076162e854dcd5a257387d2f8195f350d9bfb14247a7bb037810e71a2aef85fad00c05a0ed3758b33
SSDEEP 384:d9WHN0WPa42T3/ZqvuQuFVcdqTYD/HRN7BZss4lGsy8:Sla4mYvb6LkDvn55
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

33:91:3a:c0:b0:e0:0c:c2:1f:0c:6b:33:a3:f4:64:17:19:b8:bf:61:15:59:77:43:02:c0:d9:cd:88:72:1c:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.ni.pdb System.Threading.Tasks.pdb

System.Threading.Thread.dll

SHA256 e8cecd3a48ea98ddc731f8d1e1e6e1e58e8b19fc29aaf29f6533f780128a7c97
MD5 4133df48c2829e73babd67199dc6f8a8
SHA1 be3314d925a0ddb89b09b8285335da81304eb3d3
SHA512 a2ac5aa8eb0459ae8d1b411946782e52a01d1ecdcee5c1ce9407c3951e47c46356bb6868ef7cc02bd6a7b3074dedc128465655146266676e3aeb447c3b9e3fef
SSDEEP 384:UWcVsWVoGmJYIVnyCTXD/HRN7Ws4lGsyzI:822wzDv/5Y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a4:b6:20:2d:0a:cb:7f:02:4e:c9:fc:62:f2:95:d8:4e:5b:a7:88:71:1d:62:d9:5a:1e:b0:4e:a7:45:cd:70:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Thread.ni.pdb System.Threading.Thread.pdb

System.Threading.ThreadPool.dll

SHA256 26ee27f5243022f6660ec1f2ca2df74c4c1c3332ffdb8bd40f81660a27bed6f4
MD5 6aecb1aa2eb4e2ebeed2d52f30461a3f
SHA1 121ccd072f448271cf9b4b8097ada4c6cc3f5065
SHA512 fc5c39e8869f5fb3e124cc00c33b11bdff650ed06e59de3e7124eb4890d26cd2a0d8b6c27c6abeb5f5f354896ff0b7e5109fcabc9f0cec714ee8e6f4f53e9b78
SSDEEP 384:rWEpYWss2ezUqT1J4TlD/HRN7rkH24rlGsYV:9jzUfZDvs6j
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fa:cc:a9:f3:11:7c:48:f8:35:09:7e:ed:e1:3b:8d:b0:a8:29:a7:a0:f2:4d:8d:d4:3f:2c:a4:e7:6e:01:d6:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.ThreadPool.ni.pdb System.Threading.ThreadPool.pdb

System.Threading.Timer.dll

SHA256 c6edbf31de462e848fb0bd9700e1a49b6a8843910cde892af5d386b249836c3f
MD5 4a4a345d849843d40b98736733bcbc4c
SHA1 cfe079a339aa46e72232a71e662ef1058814cb98
SHA512 1cf2935e394ffa988bde6a23763cddca93ec4160d715ab603f2f528e241f79df24c74ef3907f57737441e6780bb3e439e6fd64f9a62189d64142963871fa0a54
SSDEEP 384:BMWsC1W1Q6ZYuM+/PTaD/HRN7QqslGs5k:BCYa2DvFT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

68:06:bb:dc:72:72:79:65:06:9f:3e:cb:17:13:9d:4d:86:1a:41:93:d8:09:86:42:1c:0f:6b:85:33:ab:2d:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Timer.ni.pdb System.Threading.Timer.pdb

System.Threading.dll

SHA256 60c17250835223521c73d6a2c0feb6018813bac31c9a48945e373d4afaf6d4b9
MD5 64c42e46b5f122fbd21042376542b9c9
SHA1 babe9d3270a1ca2052bc16bb08df2a38b5794d55
SHA512 48a64b5401e01e83b4c2c4d6d5e4e499320ef26047cc1bf4b6e623283ff4be1b29c16b3ad42943496b73803fa5d1749e3fba326ab6a0676fe03dc0feadb81cec
SSDEEP 1536:YbaHb/K7uGqhkpW/DmoTduufAYh1/7X5Jt1lvQRW:YbaHb/K7uGqhkpOduaAYhxXTWW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2c:16:61:b5:05:24:be:36:7d:91:b1:fd:c1:cd:24:35:22:12:d7:68:29:1a:66:b5:fa:62:0d:c0:0a:c5:08:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.ni.pdb System.Threading.pdb

System.Transactions.Local.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d82e45386dd298afee9b1515409b0b3c5064c65f70b51136da42a0583cdb1c8a
MD5 6777ef7b87fb116a2671c97e8952be64
SHA1 fdfed8d790ee6418907059c71581250c455e5edf
SHA512 6a42fce82ddc9286aa6febf9b77e3136c0f273cb9d23cc1782a628a25f69249e3816bfda299da99eb21d03c2d3bc8260ef9c35918053cea81c4d1e6ed7d38c64
SSDEEP 1536:DDL/bTpWRdA+me+dYQfXUg4Ud/5ACTynsdjFA1Zzf5XpK7EPBNIbkaezBdPY1Dqn:DnBe+dYQfXUg5/CGwaq81WNWK/pdz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

146590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Transactions.dll

SHA256 9cb774081d7972c3197d8577a6ae422d6947672e8a79f756c45c943e0a77da80
MD5 53e5f331bf8a0d95a4ea7a4a8a8ad805
SHA1 8db7defb102d47079ee9fa608b17dd4740f5cbf1
SHA512 3fa800a2783fbede632aa1fdf53a52e37053f8cd03d840d6852e3d19b57dc1c2ab25c4c14d3ea30e4bee0308df5234045035fa8f3a3ae297ed4ecd6966ca7ce5
SSDEEP 384:aWzCVWfC3R0p1VhN3jSFhOYmblc8Nm+ylqQZxez7tOtm19iD/HRN7erSlGsh:6b3Rw9iDveD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1b:6f:f6:e1:45:03:cb:45:e9:81:3a:59:ac:fd:0d:2b:ff:df:ea:8b:f5:c7:62:cc:7a:79:2b:59:bd:6a:93:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Transactions.ni.pdb System.Transactions.pdb

System.ValueTuple.dll

SHA256 921b2b07aa3468f0768601a429af20fcf8484fd6897738e0760debc57c794fc8
MD5 8381d57dd76738e7e3a8d2d1e7b7a673
SHA1 df04ad06c59a71867e27230c85be3c8ee7ea1016
SHA512 b53f842744481225a991a952e86188ee12a8dd9ef816af849ff6ffe01f8aaa14be9f74995350be6bc52ddb30872b4007462280af250e82713bcc1d91014694ec
SSDEEP 192:sGWtYVWmW7sRVb1qz+mSpWULwu0Sc2HnhWgN7aQWrenM/ZL1aqnajKsh+fN:/Wt2xWIRmzrSDD/HRN71ncSlGsh+N
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bb:6f:53:15:9f:f0:98:3c:3b:7d:17:15:ce:9e:ab:d3:18:69:22:77:f7:e6:5b:18:8d:29:5c:38:22:5b:f5:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ValueTuple.ni.pdb System.ValueTuple.pdb

System.Web.HttpUtility.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f0b4f4491f6efc34465605f6903aae00a092479994f82a58317b8c7b1038b70
MD5 9e08cdd2639dd7f201477463defcab97
SHA1 993d31720cf3e831d3debb7fa356b824a6da8d45
SHA512 81ec9c4fd782d6edaae2f7ae21993c423e7a0f743d0b7eef4755af3f61cdbe74450dc2579fca11075dbce932ecded4558e59d19221492db82a516805e12a99dd
SSDEEP 384:SpS0d/GznERB1am7ne53tOXvXhXlt/cKOWTLDBU1W:SpS0YbERBY8eSXvXhXlZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Web.dll

SHA256 2fee0d71c01811905560130b447c1cc19e3e1e613167e16ee3b4d91c1606ad98
MD5 41b3572f976651635b5f10bd20de6ba7
SHA1 8cf4f0bd32d3c7c18d685c4e57b9e98d8b08c73d
SHA512 ea1c5b19f2acbcac33384e352124c4ecd0e08b21b3e3f6871ef7a1408aaab9fe3f2778fd9018a03a1aa5b9f82f26beecaa8a3d39f921ac27e6d48682c1e9610b
SSDEEP 192:buWVMoqW3r1vxKL+ZhWULwu0Sc2HnhWgN7aQWgJxZAqnajKsuCIeQK:6WVMoqW71ZKLsbD/HRN7PJ/AlGsuCEK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0a:b6:e5:e3:e1:10:96:6c:c5:1f:68:c0:2e:e6:45:34:0f:e9:64:c0:87:46:51:a3:67:d8:99:03:bf:0a:7e:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Web.ni.pdb System.Web.pdb

System.Windows.Controls.Ribbon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edda070a9b787cd52d84f96e9510f52fc244b7f01c5bd3e21d9bcc4e83e27e4a
MD5 cea7091aac95d7550a15172843c6afe8
SHA1 4889127b5726c9e4c46712f578204d56e085a79d
SHA512 d53fc9c52ac28e2ab3a11f4ce11b4ffba1553f9482c7421c634ef1eefacd4563e8cc1ec7c89f5ffc38496e84a3f1f5b3f2a697d042ef25f6389827d149f61b59
SSDEEP 6144:4kPMVzklPsz+XpsdGwolRWvS616HJ6RPjdVsmx0eMaqo1T3gh4hH:bCnsdlRYS616HJ6xdoolh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

739742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7d92b08ae2852c94a7fb28a7cbdca44b24e904fe6082ca87dd32300b3ea5d125
MD5 bba97224d1bf66c9863628b4f1b2d6c2
SHA1 c17fdf4514b825376f2009eec409f53ef34bd1cf
SHA512 7048cd9a18023bde4914840852fd81b91d74bc9579c39ba1315cb8d93987f16bb8724af2bbaf648a41f52ad01359c06b23c075daec7eae1548ba40595e2f252f
SSDEEP 768:Hj3LxxcKeREGH3LLc8OIjqASsCvecaHUX9FHtAXE:D3LcHEGH372ASmca0theXE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Forms.Design.Editors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a459d7aa2291ee5d92562ee8b962cbdeacdf8cd4ea4c2efbc1f1072c2a2a4c3b
MD5 198c5bdc5b9b366e064ae12739c3fa2e
SHA1 006bd327cf2c0a6c269cd2004735d57f170224c8
SHA512 74cbe87e92a81926b7cffa83fbd482127e3ef9105cb6f3efc85b44313126daadd0b983d6fc81e00bd7ef12a1cc3f5374fba2f615f96c461c477fbbb21ec9e4db
SSDEEP 6144:Voor7kaW8zasL0f/8vVyrB/qPXwCoMHeTcaSe+:aYwJHwoMHAN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

252750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Forms.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4b2fa7643912451b55529c80dc791055a230ccfda9ef89409f2ea362d02757f
MD5 d8fcbfd35d8b7b9cc31f2056cca15dd7
SHA1 00a86227f89404d9ab053587f1de83cb2daabb08
SHA512 24fdfdc5deec0950bb767d87089387ec744613d8e1cb4e2a1e96ab05a6336781a7745b3b07c3c68d63690633905c0df50fb8a0e6fc228ad70f3f9ed04cc863a1
SSDEEP 12288:vOmjjh9Dz6oJfvTmCQJTQhOs/hmjyMCWrxkb6M4pUVL/XbE162Q0qH2iZuab+:x6oJfvTmPT8O8Mc4pU5Lm62QGi/b+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3241390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Forms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ab029148763eb4193d4551adb1c3771ae62e257c90aea24a603fdf0c54133727
MD5 378ac0638bc4e8021c52e78240b2afdd
SHA1 965ee35e964fe2a2546c94c00dd8de5c32f4925b
SHA512 370fbf186434bfc99678a5e6e4f37ec33f4c243eb2019df3ee7eac828ffce48844d409ccccbddb1b15e55756f7cd24108d2cde990f754e0117372b9af50f48e2
SSDEEP 49152:w/1AbrNeipqeoqs62tjVHwe09uErblEMP+AvDp/B8Ra1Q:6AbrNevWb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6720686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Input.Manipulations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f985b2f3546bfefa58170b8616254485fd30a22332add60bb8887656ea407b69
MD5 972308c737d655c70a0bc966e1985afe
SHA1 59fdf4715cbb6003c14fbf8749509fb46b21001f
SHA512 cf0c1a157bf6c07cc969244786e3339d0400689115cace0432ff0b3836807ef12639b3625496cd16b4181af7515047ee520889413831993e27a1990663204c38
SSDEEP 1536:uOxN1JPd1h47I6r59/ojWtU6H5oVn7xkVWzIn:uSX1iE69tk8m7xkVhn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

55486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Presentation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ce2ba973ef754a8cb3315409c487a1d151285d90270a209d8883fa0480b8182
MD5 ef5a8269c2f14b8984c6cbd723897385
SHA1 374c2f86fe9f75fa2ab37e66b59a36464529a529
SHA512 ab8f7c2f60ac45db3a347ab7489cfdd145ef82bbb5440817d432e972974add09405198cccebe752a5b07e3a3b137ca14ad6f08c44ddf2202ca576595e7210ff2
SSDEEP 96:cRdI0sUwRhRqkoidIuywtVjL+4vuU3+hD/DiilmNWX:cRddZb+ztVjC4zziYNWX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.dll

SHA256 83d0b43ee79fc7667ae8b1bd1b774b0ae72e9811020107f32f739f845dccbb87
MD5 7f59f9ea05fffa0d39dbc53c36207af6
SHA1 56491c638fc597b6ab935e8a86640cfe01ba65ca
SHA512 cb41b0d7a2490aabce6086a87e6f347c8e3bb55a0beaa0b4d9a78384e36105033b9c3ad3a28b72b6564e9335ba7bb33e6088146e6d68117760890b5f0e527255
SSDEEP 192:HtWEyFWUUaVtVxk+esWULwu0Sc2HnhWgN7aQWnfus4ptDqnajKsyFSZ:NWEyFWLaVtfktKD/HRN7WWs4lGsyi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

71:40:64:36:db:e3:08:00:a9:34:45:22:5e:04:48:61:7f:56:d5:b5:d8:70:ae:b9:1d:76:5d:99:c9:c5:5d:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.ni.pdb System.Windows.pdb

System.Xaml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 737f0208b8bcafacbbec913c2f892c02ee018d6aade76046b1423f3152cda7dc
MD5 6758c064fb14847f0c0d2773f5ac9ebd
SHA1 b6ee15f4f8312001372f17c9d5515fde8690625e
SHA512 5b3fe946e8f9e6b30bd24445db36658093806ce7aebfdf09074b2c2b68987632449d4a08711017fe0a4490bf43399ef7004dff8bf0dbdeb0b5a399b57dae6ae9
SSDEEP 6144:ib8SCbASWB+aBFCuWBSF2lj68Zk5YCzS3PDQspzSPQD//fNcuVYuNXbt:ilWn2/SAGNGSrpzSPQD//fMC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

570046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.Linq.dll

SHA256 c5de496fd7402be95023a323491ffea34370f9661a3b3434afb9956c28369130
MD5 83d4a9b9fe7c853db5aa9ccae7fb6c05
SHA1 8964e592e880abed8ed5003a9674ab2a38e9fcfa
SHA512 da97f4c697a3cee7b6c716e90d21b7161da63731d2a61a26a33b37f821ee7668ee378a13b6bc2005bedef78ebdc1472d5b52c913a37eeeac42b8747f5f4c6d5b
SSDEEP 192:KOW1UfWFMOmzP+T4gqWULwu0Sc2HnhWgN7aQWp3s4ptDqnajKsyyZUVd:dW1UfWSCHcD/HRN7U3s4lGsyE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b5:82:dd:65:a2:e8:e6:b1:f1:96:98:39:37:61:e8:e7:57:4e:01:44:f4:cf:03:b2:52:58:07:ba:09:e7:33:d2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.Linq.ni.pdb System.Xml.Linq.pdb

System.Xml.ReaderWriter.dll

SHA256 16f9aba2135e5b39746de001d4c9300e9c2acda71fdac01c9f89c2c926bb1e42
MD5 fdf6dca4218eac596f7429c2ec2219d4
SHA1 dc714ccb1e2df322b5cd0e8c50727f5b248df839
SHA512 4f8ff26a5c2e871feaf610664389d1f7c5bd0a0077aaa45c4405ecf691b0fdb7f514e2316bece0fcc3b231efc41054a9ab9359bac2d9ac743d9f2a2ad09b8557
SSDEEP 384:fW1M3WB5q5xK67ex4FCJjaY7hm0bPAXMKuD/HRN7jVslGsIE:V7LeaY7bbPAcKuDv/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e9:a9:c8:53:ea:41:b9:69:9d:2e:57:54:e6:ea:0a:47:6d:02:4e:b0:5a:69:40:ca:b2:7e:69:a7:b7:cf:d5:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.ReaderWriter.ni.pdb System.Xml.ReaderWriter.pdb

System.Xml.Serialization.dll

SHA256 9362aa0a1ea746b51599a145514abd685465ed95821f27e473db7128e618962c
MD5 4e97dd7279e8f285e84fc02f694416d4
SHA1 95c392778ce65084ba0b943e6eb2ca6b061cb867
SHA512 f1dff568cce914ab76c13034926a3a0a98f182188a4431f8131e96e194592243b10e3e4dce6888e5c33b9d5942e2ca382efecb5dd1d885fc7ba0c0cffa9e53da
SSDEEP 384:rLW7MDEqAWt6rD/HRN76X7aJdlGs4BUs:rkwEqyrDvM7aJGX3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f3:6e:ee:92:57:51:07:00:1f:2b:59:51:a3:81:5c:5a:c1:e4:34:dc:ae:ca:eb:e9:34:52:b6:b4:e8:d3:df:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.Serialization.ni.pdb System.Xml.Serialization.pdb

System.Xml.XDocument.dll

SHA256 bae5712153bf67eda2e33abb426140a33e235e65a19c8fd3856d9b62ccfbdecc
MD5 ae10bf1a701f8a8f1411365461ca470e
SHA1 7e8030d7b51d761401f59b7116f35a20d5545b14
SHA512 d246915f7b099083c745a2f85cd2edec46b35435ab0092f45295af0ceb042c6f19b0a2c6305271493472308c7e6ffd437da7f30cb80a3b3828796538225e40bb
SSDEEP 192:JMW/zKWSPJxwxo+spRcWULwu0Sc2HnhWgN7aQWjNG4EHsqnajKsYW1:aW/zKWmuoZR6D/HRN78U4UslGsYw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7b:5b:49:6e:fe:c0:fa:8e:06:5d:65:f5:f1:da:bc:ea:e3:df:4a:a7:77:54:e9:20:7d:5c:91:8c:a5:c7:d2:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XDocument.ni.pdb System.Xml.XDocument.pdb

System.Xml.XPath.XDocument.dll

SHA256 9eb5425755de36c386d9079de9fafecc37d36a1241a66e189224d9480855e3f4
MD5 e70619256c6a5b0858ed4d458d7d6d11
SHA1 f1931390924fdfc901aafb8d4da2aa53aff61038
SHA512 84fbf79dd966b6fc1af6d3b93d02deade8132f603aa6b9b35261e0e16eb2d9e729fbf7db946bc862bed03af23b87fb8e284c3e0fcaf32c653982187cfbafdcd7
SSDEEP 384:QW0e5WUVox6URHD/HRN7RR0J/AlGsuC0N:vnVoFHDv4/x1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c6:32:eb:26:2e:30:b0:49:84:bc:25:c1:9f:4a:91:ae:ca:39:8c:17:71:de:b2:0d:4f:6c:c8:a1:12:da:d9:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XPath.XDocument.ni.pdb System.Xml.XPath.XDocument.pdb

System.Xml.XPath.XmlDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5aef6270411213995e83fc1c886c2545ae7f69d3f484f0320a7ca373f66a95b7
MD5 f9b0a48e6992380cc8bc1125ee3b7df1
SHA1 4eb18e5115c8be53a61bf8a7092c479917c1ce37
SHA512 db762dfe8d4724416dc5924e3d1aa1f7685aa20788a8bb30b8b2135265a03281182adb730bb122364676088bfe6cc2f19deade4bcb53f4943b2e60182a57c88c
SSDEEP 1536:Y951R5MZ7fQMgXB0ldID4y3tZ8CA3859UJHjQJZF0f43RahBXuLNaR:wjD7XSldIDl9ZjAvBjgZF0fThBsNm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

107246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XPath.dll

SHA256 5bfada39e3d35496103a02e40aaa90e66865397ec0a2fddabd51cb0af49f3994
MD5 f547292e979726567c7dd5039743dfac
SHA1 33ac608a91a92a94a75b0616b8d48fda6991c16d
SHA512 93f3dddba59461327f58e7de87f89d2c22dd9be3a5326b9fb9a48ac25924bc6117e6cdaff79f3217a131d8bb63b2a9755d187e8bd9ca1404f61f09a53e910e37
SSDEEP 384:vWB5YWWizB16nMD/HRN7mJwmEy4lGswnydIW:UtB1gMDvty58IW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:cf:11:ac:b5:e8:58:3b:1d:f3:18:32:01:b0:ac:b7:7a:36:36:c8:18:f5:e3:68:bb:a3:6e:fc:02:ac:76:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XPath.ni.pdb System.Xml.XPath.pdb

System.Xml.XmlDocument.dll

SHA256 8fb0f790f73d396f8e7a8b4323f8acf5790d78583f0289488c7cf6de36eb2eea
MD5 09391209c6dda522f535ac1ed21b4ba8
SHA1 a28f0da3bcf8848f0f3d3e03320b1606d4947ae1
SHA512 26b441760604b3dfa7b1b325c398b96abf217cff69f1eab0721925fb176270a8757495d64f456ce88734a769a6496c4bd03be489f79e7c28cf665db7fc173705
SSDEEP 384:EiWeILWMuYz+xPD/HRN7UBwwmEy4lGswny:mvpaPDv8py5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

da:b5:20:ae:bb:c0:e3:c0:ec:8a:19:c0:d9:9e:27:52:55:c9:95:58:bb:89:03:84:36:ef:3c:49:b2:06:55:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XmlDocument.ni.pdb System.Xml.XmlDocument.pdb

System.Xml.XmlSerializer.dll

SHA256 4c0765494bf7f680898a4b68505ceeb70a2fd1d4acec1ed52551ce0215c1838a
MD5 8e4408b69d1769cfb2b2c39e908cc837
SHA1 57c05b8328a978cd55d06be9c1c7a581193784d5
SHA512 d09c9f13c011d29fb67de445ae5f55975eee4b08b274ad41b4e4c2f9b231fa1f9386bb11195894fed1e525024cb84a6052cbb3d9c801e573131d211e61a1e940
SSDEEP 384:dWpJYWMeSdFXstL6jD/HRN7M+wmEy4lGswnyQ:yOeaFXsmjDv4y5l
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8c:8a:7b:ed:6b:a6:f5:2c:4c:35:35:dd:80:0f:e1:07:d5:3e:73:bd:f2:f8:90:13:ae:76:49:c3:f2:d8:18:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XmlSerializer.ni.pdb System.Xml.XmlSerializer.pdb

System.Xml.dll

SHA256 daa77710141decf6cd2ab302959afb9434497e6eade30c428b060b0d56b795ce
MD5 092da821fd35f4017c1679622f12919c
SHA1 16db06587e0de1b3713a258b08f9d3bbceb9f521
SHA512 9b54383ecb84ca73e1e98e788d6829048c616d6ba5a46b2e06733c17e59cad6151406aed6581bf63cfb8e4b4a3f0bc5f6d8c6f99752ba22baf1d90d375fafd15
SSDEEP 384:XWKMjLWi5q/7A8bhUVGfbhoGSK2XiABD/HRN7vkpqslGs5p:+yO2uSABDvR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f3:e6:80:a1:44:89:6f:0e:f0:86:ee:a5:25:d7:00:ec:47:05:d2:4c:6c:a0:4e:dc:27:09:2d:42:e8:ea:38:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.ni.pdb System.Xml.pdb

System.dll

SHA256 907e60add556b9d5a38bd0386c84fe6c2003aa875ab43c0bf82f8396a0394a02
MD5 8ebfecbd9a88a2197eaa77f9bf088627
SHA1 2ce817275842f851b74c926a247417f9018c7df6
SHA512 96fed40e3a66f0fef3f5dedd9c65c1dd010490c6d70efcecab57c1eacfe607b5107812499ee0547bc7d83a6a2140c0cfdb3082f1d926deed9a3514aaadf08051
SSDEEP 768:Exl1eiS4RNB5JVbOd502zq1SntVRirQDdwmbEkktvqDvYL7aJGNPz:EteiSn5jzCyMkamVcv4v3JG1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

4d:4d:65:94:8d:ae:cf:5a:4e:47:2c:85:1d:28:47:f0:61:23:6e:0c:fd:8f:d2:d0:e1:3b:6c:04:fc:38:be:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ni.pdb System.pdb

SystemToolsWindows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e57f17c10c341a6811a7f83c1a2f3064d6eb2ea709d0891cd248e587920dac2c
MD5 3ab18a9db55362e6081cfb2fe2f861ed
SHA1 a9b71bbe471218b604b2a15ac2783327ac128d54
SHA512 6a21fbd5467531ca2e3349a0ad0c27c97abbd5bb5cec8b781f683c70d6cd96686ead81cff60e6e841f42bf4142b900acd3caf136d9c0101be379869a78998232
SSDEEP 6144:mzQNAI1ziaodIAB+S9np+SWSUzQsbQcMa9:ej1d9OB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

6b:5c:86:d5:6f:4b:ad:47:c9:c8:dc:91:f9:f6:45:f0:57:e5:4d:f3:b4:31:61:08:1e:cd:55:11:c0:d1:b0:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

203566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TotalAV.exe

IMPHASH bf1462ce2cfa173883d7ac57d7af7b93
SHA256 29b30d885489251ca017c2bd0d09686b61dc5078f3b3d2153af08d72c9c89bfe
MD5 6c8e6d714324c278f21768124366631a
SHA1 5e6d1d74eaee403c12517abf0bc8e78f7e9bd582
SHA512 48072c22c16869a54ce16af59684feea96a1cd1efb2230b58b427f5ecf8963c10e4fc4477803bf8d7e6dc19f211f22c1ac8df169eac760a8a84bddfe238e4b30
SSDEEP 49152:GTtYKsQo90WwGOwMV6xpDGT+vdI/EDplyDYVy1Yu1Idz1XUoxV4DQvHYxUTpUMY6:CoT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

c9:f4:25:93:51:f6:51:be:cd:5f:b0:c8:f0:32:0a:ee:07:10:d4:dd:af:42:ae:e4:f6:5d:0e:2b:8a:a5:fd:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

71312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwind RaiseException OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

terminate _controlfp_s _register_thread_local_exe_atexit_callback _errno _c_exit __p___wargv _seh_filter_exe __p___argc _configure_wide_argv _cexit _crt_atexit _exit exit _register_onexit_function _initialize_onexit_table _set_app_type _initterm_e _initterm _get_initial_wide_environment _invalid_parameter_noinfo_noreturn _initialize_wide_environment abort

api-ms-win-crt-heap-l1-1-0

calloc free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode fflush _wfopen __stdio_common_vfwprintf fputws fclose fread fseek fwrite __acrt_iob_func fputwc __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcpy_s memset strcspn wcsncmp _wcsicmp _wcsnicmp wcsnlen _wcsdup

api-ms-win-crt-locale-l1-1-0

__pctype_func setlocale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func localeconv _unlock_locales _lock_locales _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64

Trinet.Core.IO.Ntfs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f750952c56bc9800cf7436c90ef983dcec12b5d156223522c9c2156d59b12c5
MD5 bea773dcb85e63a9bade222269c62367
SHA1 1572e3baa0c7d7335222acd435cab3616dc08c10
SHA512 a9c592a8675c96df544d20a0d0c004614789e034a2add26515fb4974d8c7caa98c018e92cb6e6df682f0f6e01c01e2d23395313b3564ef34315f0b4dab0ef1a0
SSDEEP 384:3/t4aXdbHz7ipPW3IflQolQrGk26qtT70P0Oqh/rpv82kSGpBEx1Nh9NBI:3ui36+gZQr46YhhzZ6E1n9NBI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

24610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Richard\Documents\GitHub\NTFS-Streams\ntfsstreams\Trinet.Core.IO.Ntfs\obj\Release\netstandard2.0\Trinet.Core.IO.Ntfs.pdb

UIAutomationClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b09e0b101035d3ab09c709d26bb340a1d3427fd4dd14fd289c04b02e61248465
MD5 5d9fe064f8c13b72b5d5a533283f9956
SHA1 cd83373acf28b72a2c281a9353d7e88626785e04
SHA512 825ec949429ee288cbe2e17114df92e4c214ca507710400108250cf9496fc4def16ceaa3db51660f550f9c077d4d8bb2a0c3c92e5a97a5d79bef0a0b9ac5ecf2
SSDEEP 3072:UvlsUmfu+3EO2ObDtrfdUlycwzkF1jp6OoNpdw:IsUmG8BD3Uly41g
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

165118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UIAutomationClientSideProviders.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8f74c60d2afcd969ebc5a8ae59b4d7821e4bd6f0f021163537a0787158e1fbcd
MD5 888a80ea3cd4c9dc583c71f32d231883
SHA1 eb62adc1f0f5722ae53279f863e7a9589043e611
SHA512 c43719f1a83bfd5b907ce3ec0435acbf7cedc5a827d30a1b0d07a4b01f25ae79002120d05ba975e0a44bf2009127382445c298314d3252f0c1fb47b48d579a15
SSDEEP 3072:DL5BrEdf+eZQE0YmCf0vl0okcdl0LUowsZGdaVWVDQpTZS40V1l2KrKrhrar6rK5:DEJ0YmvvGc70LVWxQpf1INRpYEl9C14
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

347438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UIAutomationProvider.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0d339bfcc0d2c5426f2dacf4b975962797299a313871fa4f79664619032b7c8c
MD5 9dd7428a0417c44712fd8e184baff5e7
SHA1 556183e70fd9c86c7c4f5c3405c0691397dd70c0
SHA512 b841155454ed7f5bf9ec99c1f299b03fee5dfa987d19c2aaa6c008ba87bc7d7a8c35b604c5d8c112a2ce02671a435ab7dfce6e36224c41fd0c94703b4b72dc3f
SSDEEP 384:SL7g5TJXZEt4EidWtchSNSNOKyyXXkdYLwmT7FiypOULMeXeHAQIjDZBv0gAxSXz:S4TXmt44cN8WwYLMRH/P6pV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UIAutomationTypes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f7660c9fdaed8d2af59437627d3da65cf2fea316519e9e100bf529fb838e3627
MD5 ee792215d7595d6f8634588d9c25393c
SHA1 814425b0fe2802f4b10674c63f8c09e0d6745e15
SHA512 687b606cf506eb4db76c4f4b9701b91184d6dac085a93fb4f951bf0d4ae09403a85077adcf69fe467672010c2225ddb446943937982f7a0e5efecdae588851f3
SSDEEP 3072:d7QRqWWxPzk8vpLB1B9dO73uwVfa9/xoEviy0gVQZLnIJLFjtcXBtecZ547:dsR38hpUFcPpviyJ+ZLzR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

206158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UiPath.CoreIpc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9bafce0aaf0b7de10fbd61cc068d9d19e5fb60d06f7a56f6f3d7e45acbefbba
MD5 6f4c04eadd5b5ba7d42ba3f0ea2a3ba0
SHA1 d0921f38f909aa9432ee7df9f36e0c922541a2fd
SHA512 9346842919377d0353f3ac13f8a8dc108c128a8e0f70c0a5074ccb054e94c59394c70ebb5dbed7667828d7d4d4e62428db2151645df4caa44340f80133439134
SSDEEP 1536:Q27IpClA1busd/RI+XTJZ1mK+ZH5h4ZdGCZdZ9uE8B2:YpmALVRIwAK6h4ZdTl9QB2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

84286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.NotifyIcon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 173b1707e0abb7f7a183a773753bdabe115be957db742f613ddb9a8ec2fa5213
MD5 6acb8625b51e552962f2920b5ef03840
SHA1 a6f66e37eae30e7ed6c50c7f2d7b2415e1bdc762
SHA512 47e3776574fa84756c815b60e5efd3b004f4baa46c17238f08eac31cb043c026a4eff5dea649842c12b80224a5d6c892a548e005301fe99063b6a83ce84d7810
SSDEEP 384:NgK9qM/AK96GuYzZsaZQouWv/tjtkIRkormYz9zCP4/lD9W+ms+tfnZkXzKTVDAQ:19pGWv3kI3h2mJ9in+aEiJI+ssp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Utilizr.OpenVPN.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1ed8852f1b0af475bf463d0ec614f2dd85b4c5b9143b7a4d5df4e7bd02906a33
MD5 11a92a71480ce9ad5c27908950c7849a
SHA1 d3ce8cda3d1ae5d4391c514617a8427d1f236ef9
SHA512 b8aedc774e8e07bd8cf49803ce196a38a0cb86176c54432d3f204fd37d30d040f72e3bb053a7de7157ed5edc6a53369a6696b7e5740358e32b3e64cc7baf79b1
SSDEEP 768:9PdHrL+OJdTMFhhSv42US2YI10eqw+Ol01q8oj:9j9MFbSkwILWAD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

39358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.Ras.dll

IMPHASH 0a0ed7d8a29f00896bf4e02c44f002bd
SHA256 72af88e76deec33153d4f6b8177cc0039a4eb3409d58dc0ff878f5935839c052
MD5 451c3464f7838f4a8d6c0bca8e31a66e
SHA1 764c8d7c9ad9cdc08671cfba4825bfb598b221af
SHA512 9e88b855eb80639e39d40e6c1961127cfe135ae624f173ecea6fc2cf59f1791cc435a482b125eb55f74b5772032b525061e4c473a351f0ce015a32af068ca3bb
SSDEEP 3072:/7qEr7dz6FynyhgHOLyd6q37DV5mPCcLqzCxG:9QFyiZLO93ldQG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

a9:f3:71:9e:b9:d0:87:ef:04:ce:1e:c3:2f:c6:bb:ad:99:ad:d3:d7:ee:b8:a2:65:9c:5a:fe:f2:73:6c:44:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

7212

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Utilizr.Ras.pdb

rasapi32

RasGetConnectionStatistics RasGetConnectStatusW RasEnumConnectionsW RasDialW RasGetEntryDialParamsW RasHangUpW RasSetEntryPropertiesW RasEnumDevicesW RasValidateEntryNameW RasGetEntryPropertiesW

kernel32

GetModuleHandleExW RaiseException DecodePointer WriteConsoleW CreateFileW CloseHandle HeapSize HeapAlloc GetProcessHeap HeapReAlloc GetLastError lstrcmpiW HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleFileNameW LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx GetStringTypeW

Utilizr.VPN.RasSharp.NetCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d246199e5acc610112b3340dbcdf23b25fd61351c5e6191954fa7c627e03e869
MD5 c42854e0c633c099213c299b13ff559f
SHA1 f33d70ac69b2c1bb176a28b2513d673d6f558dbb
SHA512 af324328e9488f94b21a1c29eeffd0290aadd9d25fff2ba771412227de71d593674db78c2532d1b8f12d9feed55740a3c1f5a401ffe5790dd84285c8065d0e80
SSDEEP 384:lJTHdFR7pKlYZTRXufgjnXbMB4/BR2xOujSsDUs3jS1eDP:ljbVKl8TRTnXItGa73j6IP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.VPN.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d8934a45aa9484507fe0adb3be5b9d9ec502b82ca0c4e7c842a1633552521de8
MD5 8a2f51cc51aec7e10b07fbacc1bd32df
SHA1 384caf4730a090761188a1c6903b72816756793c
SHA512 5bb04be8a92833ca7abb6c75fa2116b5dec53253a442523f9c52e4085e8a97b1a82c6351158d54041a06b70046b8f7d25164f6472f0e6a6547d63a1e0b7d71c3
SSDEEP 768:44VfcIJSjHp9EAebnXsH+r77BsD08bvclQSmHUFCWM3:4k+2XsHm77B408bvclQvtr3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a80338cca08e2b94b2c06c73b0b035bc4b1483d1548e206a2a4f68e671138e0
MD5 8d3e9650b00f1e99964c0d7907f47e91
SHA1 c21e910d18f96a244cc080d1659276fc8f0c3b9c
SHA512 0299c03912319ede0fdf9e55a67a7825d2d29c0dbf451d0bce86b389bf3a446a7cf9355697a222e4e8b4142c08cc878c390c5a6604b367cd641fd38223c700d1
SSDEEP 6144:WekO3XPsiwzevESk+R4bcKmb4Sktdz1rZQwgnbUbelo9lwFI907MKP:NkiwzevESRNbZEnQwg0lrWp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

410302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilzr.WPF.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8b28f496362a5dbb73422086d750e04ffb97bb6fadd89057d14b026d6e1fb267
MD5 a665407db9191b875987a855fbca2530
SHA1 46e664d1edf6b5cfb6378b68769874eb6b29ba30
SHA512 88b1de7394a11328cabef5167ffd4c931368ddfbcc7ec469b8562af56b5f5b885aba5aee681cc4ae2d035fccd0280c08c83b2b7234ab0ed88090c7675ad4e321
SSDEEP 6144:ZRoAzvKSorAMb0QTJV8ZrgHoQs7WmoV0GbZzUToARrYvYlGj34m:4AGXUQln9yWmoV0GbZz/j34m
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

402542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Webshield.Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bff22312ddfe489de196f4a27cc7ad5acf28c03d25b7d5c247f4796ec876d435
MD5 4b7a23a9d9681b80622db680faf6b45e
SHA1 f8b9771ddcaa3ebda495b07704e3b975a0354614
SHA512 aafcdb9e6ce4efe499ae32d9126be60b2a2a5c009107e60d559eb6f042d2857f7136bf3d7fcf98efed5b10fd489e16380920dc6f2dddb8b53502d80c016b3dc8
SSDEEP 768:+gZyVxhp2wcOnjLBtZ/yKHVgGzrJezhYpzSmudom+Z:VyEcJeB8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

41230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WindowsBase.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3ce46f1b6f2d262069fb680ee017b7a917afe266fb650f2735499186f950ce
MD5 403baa01ac1a62a438d94b8eb2398b81
SHA1 d0cfaaed88db5f65b1d93061ccf3876a61ac767c
SHA512 386c00f5ace55f4572841f00d32da5cbae33ccb22c273953619bf11aba225dabc000ddb6ba431f718f1c198a122ae922e05d90a78f41397866fec47b07860930
SSDEEP 12288:haPf9iS2FrHhySjvmP0aTSYsEF/15G6zLuVGdLeESOLWQF/RIciy:hadIHhnmPTSmTdzLuOKXRw/Sfy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1052110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WindowsFormsIntegration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f5c2639183a7989db404e4cfaf1a97c98e8419bdbc6589be45d9b6b17a77525a
MD5 b075e42730722c20207cd29a3960ab0f
SHA1 9668fa79d3f1cfaaf218b9b566b6af1b3d7ab2a7
SHA512 8858a6d984d63d81e56ef0fd9a87823039317d2329f6fde035d0e92dc8179c917267b004242559b154c2e355b220eb0efed43adc0e5dbbf68283338fd065456a
SSDEEP 1536:7A4yZgAOFEDfIptdL8Q9+lrmmMeIUGMp/zWtDxVf8oTIA4999rjrl5qT0B98KTJa:7Dy6AHg39+BIUGMp/zW5xVfD4999Tl5Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

91374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-console-l1-1-0.dll

SHA256 24b07028c1e38b9ca2f197750654a0dfb7d33c2e52c9dd67100609499e8028db
MD5 aabbb38c4110cc0bf7203a567734a7e7
SHA1 5df8d0cdd3e1977ffacca08faf8b1c92c13c6d48
SHA512 c66c98d2669d7a180510c57bab707d1e224c12ab7e2b08994eb5fd5be2f3dee3dbdb934bcb9db168845e4d726114bce317045027215419d3f13dcfa0f143d713
SSDEEP 192:aBgW1hWi7u7jCjdks/nGfe4pBjSYpP4W5RKTt3E2sVWQ4GWc6CT7yqnaj/6g6dyh:dW1hWLam0GftpBjhFm3S4xltZEU
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

78:01:8f:1a:1e:e5:e3:d8:12:34:d0:63:8c:e3:c0:73:5e:2c:98:83:9a:54:39:85:48:6f:ed:ce:f5:13:0b:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

1f:1a:e3:ca:4c:2a:c2:0d:00:a4:8c:51:18:6b:d2:53:27:5d:be:bb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-console-l1-1-0.pdb

api-ms-win-core-datetime-l1-1-0.dll

SHA256 c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60
MD5 8894176af3ea65a09ae5cf4c0e6ff50f
SHA1 46858ea9029d7fc57318d27ca14e011327502910
SHA512 64b31f9b180c2e4e692643d0ccd08c3499cae87211da6b2b737f67b5719f018ebcacc2476d487a0aeb91fea1666e6dbbf4ca7b08bb4ab5a031655bf9e02cea9a
SSDEEP 192:fW1hWiH+49Cjdks/nGfe4pBjSY285a+W5RKTt3E2sVWQ4GW2TwE9qnajuZDAJaaj:fW1hWZ4wm0GftpBj8m3SLwwlUKTf
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

af:2c:95:94:4c:b1:1b:99:46:db:28:c1:f2:10:db:14:7b:5d:6a:8b:30:76:fc:f3:a3:cc:f0:15:b0:ba:a6:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

1c:49:85:91:05:43:17:cb:f1:63:7f:31:a2:21:c8:d3:38:1c:0d:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-datetime-l1-1-0.pdb

api-ms-win-core-debug-l1-1-0.dll

SHA256 7e4cba620b87189278b5631536cdad9bfda6e12abd8e4eb647cb85369a204fe8
MD5 879920c7fa905036856bcb10875121d9
SHA1 a82787ea553eefa0e7c3bb3aedb2f2c60e39459a
SHA512 06650248ddbc68529ef51c8b3bc3185a22cf1685c5fa9904aee766a24e12d8a2a359b1efd7f49cc2f91471015e7c1516c71ba9d6961850553d424fa400b7ea91
SSDEEP 384:uW1hWcFm0GftpBjOQElEm3SQalndaYhppz:llVijElEXj
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e7:92:28:8a:ca:d5:86:28:22:34:3d:dc:71:26:1f:9d:a6:2d:8a:4f:4c:5c:6f:29:5a:3e:64:d1:ad:e3:1b:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

6f:d7:34:01:66:da:08:66:42:62:d4:44:cd:4d:29:4c:c7:3b:16:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-debug-l1-1-0.pdb

api-ms-win-core-errorhandling-l1-1-0.dll

SHA256 f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492
MD5 d91bf81cf5178d47d1a588b0df98eb24
SHA1 75f9f2da06aa2735906b1c572dd556a3c30e7717
SHA512 93d1b0d226e94235f1b32d42f6c1b95fadfaf103b8c1782423d2c5a4836102084fb53f871e3c434b85f0288e47f44345138de54ea5f982ca3e8bbf2d2bea0706
SSDEEP 192:cnmxD3jW1hWiRcvHCjdks/nGfe4pBjSYrteMMPiW5RKTt3E2sVWQ4GWCxMfqnaj9:cn4W1hWiQim0GftpBj9eXm3SR6lPp/
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:bd:7c:32:14:8c:fe:34:06:44:f9:bb:b2:e3:0b:5f:a3:a0:72:57:55:36:7c:38:4e:ec:57:3e:06:0a:70:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

9b:f6:ae:be:57:bd:40:80:95:1a:31:a9:b5:23:73:64:80:3d:61:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-errorhandling-l1-1-0.pdb

api-ms-win-core-file-l1-1-0.dll

SHA256 1d1c11fc1ad1febf9308225c4ccf0431606a4ab08680ba04494d276cb310bf15
MD5 eefe86b5a3ab256beed8621a05210df2
SHA1 90c1623a85c519adbc5ef67b63354f881507b8a7
SHA512 c326a2ca190db24e8e96c43d1df58a4859a32eb64b0363f9778a8902f1ac0307dca585be04f831a66bc32df54499681ad952ce654d607f5fdb93e9b4504d653f
SSDEEP 384:Y6PvVX7W1hWC1m0GftpBj4xm3SBvlmTwhsH:jPvVXeTVic1i
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

00:c4:35:21:a2:04:3b:c9:c5:7f:4d:4b:6c:da:d0:38:aa:75:92:91:c1:c5:66:86:8f:32:c8:78:79:05:e4:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

6d:7c:e4:74:3d:15:aa:58:38:90:db:48:88:42:62:88:c5:8a:8a:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l1-1-0.pdb

CompareFileTime CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DefineDosDeviceW DeleteFileA DeleteFileW DeleteVolumeMountPointW FileTimeToLocalFileTime FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstChangeNotificationW FindFirstFileA FindFirstFileExA FindFirstFileExW FindFirstFileW FindFirstVolumeW FindNextChangeNotification FindNextFileA FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeA GetDriveTypeW GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleA GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLogicalDriveStringsW GetLogicalDrives GetLongPathNameA GetLongPathNameW GetShortPathNameW GetTempFileNameW GetVolumeInformationByHandleW GetVolumeInformationW GetVolumePathNameW LocalFileTimeToFileTime LockFile LockFileEx QueryDosDeviceW ReadFile ReadFileEx ReadFileScatter RemoveDirectoryA RemoveDirectoryW SetEndOfFile SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetFileValidData UnlockFile UnlockFileEx WriteFile WriteFileEx WriteFileGather

api-ms-win-core-file-l1-2-0.dll

SHA256 9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
MD5 79ee4a2fcbe24e9a65106de834ccda4a
SHA1 fd1ba674371af7116ea06ad42886185f98ba137b
SHA512 6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c
SSDEEP 192:Y+W1hWifcvHCjdks/nGfe4pBjSYA89sX5W5RKTt3E2sVWQ4GWFuLOgVqnaj6uDp6:Y+W1hWoQim0GftpBj7sIm3SFOslD16hP
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:8c:97:81:85:48:aa:1d:d4:f2:e3:3e:90:c1:c6:db:8f:cb:ab:59:89:3c:de:f2:e9:8e:7e:b7:37:31:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

c7:5a:78:70:ff:34:aa:28:49:4d:2c:57:ae:ad:99:8b:9a:85:88:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l1-2-0.pdb

api-ms-win-core-file-l2-1-0.dll

SHA256 ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
MD5 3f224766fe9b090333fdb43d5a22f9ea
SHA1 548d1bb707ae7a3dfccc0c2d99908561a305f57b
SHA512 c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca
SSDEEP 192:FZkW1hWiecvHCjdks/nGfe4pBjSYo3Vq34W5RKTt3E2sVWQ4GW2rOqnajd2siD+k:MW1hWdQim0GftpBj4VuFm3SWlg+0mw
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7e:ce:c2:e0:6e:f8:7f:0a:cf:3a:5b:44:ba:ed:d5:c2:a1:a7:dd:90:87:4e:3e:15:a0:56:c5:06:b1:c7:85:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

78:3a:91:1b:dd:8f:2c:2f:d3:a3:7d:86:9c:dd:87:9c:03:05:b4:b4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l2-1-0.pdb

api-ms-win-core-handle-l1-1-0.dll

SHA256 dba84e704ffe5fcd42548856258109dc77c6a46fd0b784119a3548ec47e5644b
MD5 18fd51821d0a6f3e94e3fa71db6de3af
SHA1 7d9700e98ef2d93fdbf8f27592678194b740f4e0
SHA512 4009b4d50e3cb17197009ac7e41a2351de980b2c5b79c0b440c7fe4c1c3c4e18f1089c6f43216eaa262062c395423f3ad92ca494f664636ff7592c540c5ef89d
SSDEEP 384:4W1hWypFm0GftpBjTnom3S4tOlDCEY5kD:zvViFoUtQ1Y5kD
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:29:82:a9:07:32:c9:dd:95:e1:2d:ac:d6:88:12:65:ad:a0:ed:14:92:66:ef:2a:89:ad:c4:c7:fc:e2:c4:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

3f:32:f2:4a:32:77:c7:b4:c2:76:97:8f:6b:5c:71:99:fe:4e:c2:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-handle-l1-1-0.pdb

api-ms-win-core-heap-l1-1-0.dll

SHA256 535e9d20f00a2f1a62f843a4a26cfb763138d5dfe358b0126d33996fba9ca4d1
MD5 ff8026dab5d3dabca8f72b6fa7d258fa
SHA1 075c8719e226a34d7b883fd62b2d7f8823d70f1a
SHA512 9c56ff11d5843ba09cd29e3bc6c6b9396926c6a588194193ba220cfa784b770ab6756076f16f18cfea75b51a8184a1063ef47f63804839530382f8d39d5cf006
SSDEEP 384:nEleW1hW59XRm0GftpBjywVpm3SJflndaYhp6a:uADVig69F3
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0a:fd:cd:0d:02:b1:73:f7:b5:2d:8f:6a:60:f9:7e:2b:7b:8b:52:af:9a:68:ed:d3:51:2e:5a:ab:37:70:1d:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

47:78:05:72:78:49:45:96:58:01:fb:ef:6b:52:d2:51:0b:ee:77:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-heap-l1-1-0.pdb

api-ms-win-core-interlocked-l1-1-0.dll

SHA256 4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483
MD5 cfe87d58f973daeda4ee7d2cf4ae521d
SHA1 fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a
SHA512 40eb68deb940bbe1b835954183eea711994c434de0abbdea0b1a51db6233a12e07827ad4a8639ae0baf46dd26c168a775ffe606c82cbe47bae655c7f28ab730b
SSDEEP 384:l5iYsFqW1hWfsngm0GftpBjWfshFIvgCcm3SHlg+0Ix:loZngViwfsh6gxfx
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

43:ba:ca:fd:b1:e3:f6:6e:41:1d:89:2b:d7:34:51:5c:30:ee:5f:90:5e:49:24:67:2e:ba:88:36:5c:1f:63:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

7d:aa:52:4d:98:7c:0a:aa:11:33:5e:75:9f:40:7b:a8:bf:cd:77:cb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-interlocked-l1-1-0.pdb

api-ms-win-core-libraryloader-l1-1-0.dll

SHA256 2dd4ebaa12cbba142b5d61a0ebf84a14d0d1bb8826ba42b63e303fe6721408df
MD5 0c48220a4485f36feed84ef5dd0a5e9c
SHA1 1e7d4038c2765cffa6d4255737a2a8aa86b5551c
SHA512 e09951785b09f535340e1e6c256df1919485b4dad302b30d90126411cc49a13807b580fa2fcd0d6f7b64aac4f5b5ea3e250b66035a0e2f664d865408c9b43d48
SSDEEP 384:b+g4vuBL3BmW1hWZ1m0GftpBjLOoZm3SNvVlgCopp3y:b+YBL3BdOViUyRv4Hn3y
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b7:67:8f:9d:8b:64:26:b6:50:45:14:4d:a8:58:14:21:d7:75:1d:4d:bf:90:46:16:10:01:cd:8f:aa:b0:1f:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

8b:9a:c0:f8:b6:9e:4a:89:bd:33:82:f4:99:5f:54:27:0d:38:0c:62

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-libraryloader-l1-1-0.pdb

api-ms-win-core-localization-l1-2-0.dll

SHA256 a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41
MD5 23bd405a6cfd1e38c74c5150eec28d0a
SHA1 1d3be98e7dfe565e297e837a7085731ecd368c7b
SHA512 c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21
SSDEEP 384:9OMw3zdp3bwjGjue9/0jCRrndb5W1hW54wm0GftpBjvTNvwm3SBMltZ2m:9OMwBprwjGjue9/0jCRrndboUFViZ2Vu
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cd:fd:93:90:2f:62:5a:8c:a9:17:2f:38:d4:53:83:78:49:3d:28:7e:b0:0a:13:5d:81:27:49:1e:b9:b1:32:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

b5:c8:23:76:1e:eb:6a:89:52:d9:4d:5c:c3:0f:e6:f4:1e:ae:05:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-localization-l1-2-0.pdb

api-ms-win-core-memory-l1-1-0.dll

SHA256 ec573431338371504b7b9e57b2d91382b856aabf25d2b4ad96486efb794c198e
MD5 3940167ffb4383992e73f9a10e4b8b1e
SHA1 53541c824003b0f90b236eda83b06bec5e1acbf5
SHA512 9732acaa4db773f4f99f423d9feaebb35c197bbd468922348e0ad086f7131d83f6d9714dc7d375183e7cb8920cfe37f3da19b0041a9063cc60abe183375b1929
SSDEEP 384:tbtW1hWwDzDm0GftpBjQxY8m3SSlPpT2R:OzViiDqp2R
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

64:4f:5f:ec:c3:70:6b:7a:33:e3:79:1e:12:71:74:34:cc:ae:40:40:69:68:37:bd:70:72:ef:23:dd:3c:42:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

a2:3c:79:d1:08:d2:8d:fa:b7:08:c5:8a:92:d2:bf:a3:fd:67:ba:e4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-memory-l1-1-0.pdb

api-ms-win-core-namedpipe-l1-1-0.dll

SHA256 dbd788b1c5694d65fa6f6e2202bfabb30adf77eb1973ceb9a737efb16e9edae2
MD5 990ac84ae2d83eeb532a28fe29602827
SHA1 0916f85cc6cc1f01dc08bdf71517a1dc1b8eaf78
SHA512 f0e4705a6890b4f81b7d46f66ca6b8ee82f647e163bce9ecad11d0bbd69caf4ff3c4f15e0d3f829c048b6849b99a7641861e6caf319904d4d61a6084f10da353
SSDEEP 192:DW1hWBuI2WksSrCjdks/nGfe4pBjSY7ecjkUA/W5RKTt3E2sVWQ4GWZ0MVqnaj6f:DW1hWQ3szm0GftpBjH2Wm3SPAlD16h9
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

23:ae:39:00:e6:ae:18:b5:f8:c4:39:3b:d7:95:df:b2:08:60:73:9f:ba:1f:88:80:da:eb:c3:6b:43:4f:06:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

34:5d:e5:e5:a8:b7:2e:25:0c:f3:dc:e6:42:b3:13:ba:db:54:fb:35

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 2, 2017 - Jan 2, 2019

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-namedpipe-l1-1-0.pdb

api-ms-win-core-processenvironment-l1-1-0.dll

SHA256 9f1f26794fd664e0a8b6fbd53bfca33dcf7b0dc37faf3eb7782bc38dff62cd8c
MD5 0c700b07c3497df4863c3f2fe37cd526
SHA1 f835118244d02304de9eb3a355420ba9d0bd9c13
SHA512 8042dbd9e80e33e41993887b0289e143e967544389500ada9296b89bda37bb26918e4f370f8a1bdab8faacc4e0a6980794d6a3b5320e170ad4ef751384c9f0a8
SSDEEP 192:qHW1hWinluZCCjdks/nGfe4pBjSYUe0DFtct2W5RKTt3E2sVWQ4GWMZ6k8xL9qnP:qHW1hWRFm0GftpBjqt2m3Sn6R5lUKT4
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

5f:79:ef:1d:94:3a:28:42:c9:3d:20:bb:e8:62:53:50:8f:8f:79:1e:fe:80:80:e2:9a:b9:88:3c:28:4f:51:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

d1:6e:99:7e:0a:cf:c6:7b:4b:69:75:5d:08:cf:69:e1:7e:f2:43:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processenvironment-l1-1-0.pdb

api-ms-win-core-processthreads-l1-1-0.dll

SHA256 4f187f1b4b14763360c325df6b04d3ec3cc6d2cecc9b796bc52a6c7196b0b2cc
MD5 1dda9cb13449ce2c6bb670598fc09dc8
SHA1 0a91fe11b9a8321ca369f665a623270e5ac23176
SHA512 4e106c8a52033352c91b65cf65ec459de764c125136333a2f4ba026efdde65f3f71b1f6f11e4c580150ac8a9779825ba5e2af0e14df999a198cfe244e522c28d
SSDEEP 384:Sfk1JzNcKSIdW1hWuQim0GftpBjuksUm3SlSlDCE4E:pcKS1/fVi4Uy14E
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2f:da:90:4d:d6:ce:cf:1c:30:ab:54:fb:28:86:0f:ae:c8:fb:3a:e8:be:53:f0:42:94:4e:9d:9e:c3:14:19:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

38:89:85:fc:bf:3f:6e:91:48:3f:d5:20:49:5b:3a:bf:21:d5:7a:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processthreads-l1-1-0.pdb

api-ms-win-core-processthreads-l1-1-1.dll

SHA256 ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1
MD5 95c5b49af7f2c7d3cd0bc14b1e9efacb
SHA1 c400205c81140e60dffa8811c1906ce87c58971e
SHA512 f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3
SSDEEP 384:NS8DfIelW1hWu4wm0GftpBjBFm3SzlJrI:NSLecfFViRTs
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:2c:25:6c:9d:a9:0a:3c:ab:98:f6:67:6b:55:d8:f3:82:39:31:90:c8:62:16:44:1b:23:f6:43:77:30:f5:a1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

9d:ea:4a:07:4e:a9:ca:3c:27:4a:3c:c3:43:34:1d:c5:26:39:e6:49

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processthreads-l1-1-1.pdb

api-ms-win-core-profile-l1-1-0.dll

SHA256 f941c232964d01e4680e54ab04955ec6264058011b03889fe29db86509511eba
MD5 cedefd460bc1e36ae111668f3b658052
SHA1 9bd529fe189e0b214b9e0e51717bdf62f1da44ea
SHA512 2c845642b054bc12c2911bfe2b850f06fecafef022180c22f6ffd670f821e84fcad041c4d81ddadb781ddb36cb3e98dfe4eb75ec02b88306ef1d410cbb021454
SSDEEP 192:DgW1hWiIOuDz7eCjdks/nGfe4pBjSYpRrW5RKTt3E2sVWQ4GWN/VWkqnajTWOwCd:DgW1hW7DzDm0GftpBjem3SShlgCopp2
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

36:ce:a9:d1:a1:79:ef:9a:99:f7:17:f2:06:55:64:c8:8f:ec:83:c2:33:b7:11:fd:d7:89:95:b7:c3:64:af:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

5b:3c:1a:8b:f2:0a:e4:63:15:a2:1b:3b:00:54:09:c5:f7:f2:c7:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-profile-l1-1-0.pdb

api-ms-win-core-rtlsupport-l1-1-0.dll

SHA256 966a38ed7034f8d355e1e8772dfc92f23fb3c8a669780ed4ac3b075625d09744
MD5 65fc0b6c2ceff31336983e33b84a9313
SHA1 980de034cc3a36021fd8bafff3846b0731b7068e
SHA512 f4ebc7a6d12ae6afa5b96c06413a3438e1678b276b1517da07d33912818fc863b4d35cb46280f12cf90e37bc93e3ab5e44ea6f75767a314c59222b7d397e5b6a
SSDEEP 384:A6uGZW1hWZ4wm0GftpBjfNDm3S3xlgCoppl8uOf7:wGIQFVi3DsHnlVOf7
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c8:c8:c2:cf:b8:4e:cc:05:89:3b:a3:4b:50:a0:d6:81:27:c9:48:9f:1b:e2:46:4e:ca:91:0f:15:07:88:12:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

f0:77:4d:4d:1f:01:e9:6b:f2:cf:96:cf:a9:2d:b3:7f:c2:d7:4d:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-rtlsupport-l1-1-0.pdb

api-ms-win-core-string-l1-1-0.dll

SHA256 339966ae75675a03f628c4ddd5d3218abb36cbcf6ddce83b88c07336d732b8ae
MD5 e7a266dd3a2a1e03d8716f92bede582d
SHA1 d4b97ce87c96de1f39fea97cca3992d292b2c14e
SHA512 31168663fd71b901b1b9152ff288d4e1567003e5fcd1f1c9dfe36d26d2eb16b0932ec8cd34833dab25531f768a01de45c2483f92d4e79f92a89389c02bc05156
SSDEEP 384:EyMvlW1hWBYBm0GftpBjnmm3SC1lDCE9xt:EyMvcNViYm19xt
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d0:c3:94:fb:5b:b7:25:2a:1e:07:11:83:b1:63:0a:93:cc:29:8e:7b:16:e6:21:e1:e2:0d:e5:85:04:85:a2:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

41:45:7d:08:bb:e9:93:df:35:44:b8:20:69:8f:04:66:14:95:d9:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-string-l1-1-0.pdb

api-ms-win-core-synch-l1-1-0.dll

SHA256 cc76a4e82e0e0cd08df3bb8f5ad57142305e0f666cc32599d76e363d0b43efcb
MD5 c1dcdb0fabc8ae671a7c7a94f42fb79a
SHA1 99355912d7a7d622753b2a855cae4f5a4e50146f
SHA512 6d92e7520aeebfe60aab43d6616b76a2dd385edcaa217db60003a0c0cbcb0e367063d240e38a19d0b8bee2f2e7d4b982c4f08c8e9ccf34c7f670cb49f6561fff
SSDEEP 384:rdv3V0dfpkXc0vVa7W1hWf1m0GftpBjum3Su5TlD16ho:rdv3VqpkXc0vVaewVi4a5l
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2d:f5:22:84:1c:25:3f:6c:9d:51:6e:b5:80:cd:e5:1a:60:57:f9:de:69:2f:d3:fd:b6:5a:1e:bc:e7:e9:6a:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

63:bb:37:03:dc:c2:3a:ff:fe:88:77:de:4e:57:ce:7d:4a:c8:33:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-1-0.pdb

api-ms-win-core-synch-l1-2-0.dll

SHA256 758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
MD5 6e704280d632c2f8f2cadefcae25ad85
SHA1 699c5a1c553d64d7ff3cf4fe57da72bb151caede
SHA512 ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6
SSDEEP 384:DtZ3UW1hWxDzDm0GftpBjEILkm3ScrlPpU9:n0ViIQxi
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4b:fb:31:6b:fb:ab:16:71:db:ab:01:04:73:51:ce:7c:46:23:ad:cb:9d:bf:e4:9e:e2:11:22:a4:b8:cd:93:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

99:f4:e2:aa:40:53:a0:1a:eb:76:a7:89:ae:04:44:c4:3b:71:68:2d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-2-0.pdb

api-ms-win-core-sysinfo-l1-1-0.dll

SHA256 f94210b39cdc812beb7342a47e68673ea2116d0ad9266fcf8d7cedaa9561fc38
MD5 887995a73bc7dde7b764afabce57efe7
SHA1 363fd4e7ad4a57224e8410154697df5e8629f526
SHA512 d088eb1c6958774e20f0e2884136b4e2b978efd16f557dbc55e64011abbce0768054f7e6d881c110182824143a39101fdae273ed614738aa7ba5c727b27f6677
SSDEEP 192:4Lv12KIMFAW1hWBATVCEmCjdks/nGfe4pBjSYeXwfFzW5RKTt3E2sVWQ4GWURDPV:4LN2NW1hWavm0GftpBjtfFam3SvrlJrV
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

57:a9:6b:9b:b3:a9:d7:19:ee:c9:3f:19:48:7a:55:62:fb:69:71:c5:3d:91:fe:e6:d4:67:aa:69:01:70:77:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

b5:77:64:1a:5b:2d:70:49:d9:5e:e4:17:a8:f7:98:8b:a7:f5:8f:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-sysinfo-l1-1-0.pdb

api-ms-win-core-timezone-l1-1-0.dll

SHA256 b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
MD5 c9a55de62e53d747c5a7fddedef874f9
SHA1 c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad
SHA512 adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb
SSDEEP 384:rWW1hWv4wm0GftpBjgpm3SSP9lndaYhpwe/:ReFVi02vZ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

67:35:00:8b:0e:3d:24:43:61:28:fd:99:c1:81:a4:d4:aa:2e:82:99:d2:67:27:49:7b:f9:79:99:cd:de:26:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

78:03:56:c4:15:66:e4:ee:ed:d9:e5:a4:bc:02:16:44:28:25:a2:71

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-timezone-l1-1-0.pdb

api-ms-win-core-util-l1-1-0.dll

SHA256 34c5dee6d566252c0ceb7d9a21e24d5f297af2b26c32e0c7808bbd088aa9a6a9
MD5 29e1922b32e5312a948e6d8b1b34e2d9
SHA1 912f54be8438f45e1562a47294091d522cd89356
SHA512 837cd03ee0195dc94bab0662ff3b8cd1be2dedd8a3254318d25dfea6e88d07211186fa367f41ab864560e10a22220deb3ed05ccf82d60ac80c71dfed08afbea3
SSDEEP 384:dW1hWxDzDm0GftpBjDNtfm3SXl4aRGW6acyjR:0oVitL2GjR
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d0:0e:b7:5a:65:1e:9b:bd:09:fc:95:29:0e:83:9d:65:3f:5b:c2:37:d0:70:54:23:9e:f3:bf:dc:2c:10:83:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

d0:8c:e9:f5:b1:5d:d9:eb:91:51:f9:0f:2c:c4:17:15:04:51:4c:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-util-l1-1-0.pdb

api-ms-win-crt-conio-l1-1-0.dll

SHA256 a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503
MD5 a668c5ee307457729203ae00edebb6b3
SHA1 2114d84cf3ec576785ebbe6b2184b0d634b86d71
SHA512 73dc1a1c2ceb98ca6d9ddc7611fc44753184be00cfba07c4947d675f0b154a09e6013e1ef54ac7576e661fc51b4bc54fdd96a0c046ab4ee58282e711b1854730
SSDEEP 384:tW1hWv4wm0GftpBjp+m3S1ZXlndaYhpt1:k+FVib+ZvN
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e0:98:8a:0f:b5:85:21:2a:4c:7f:b0:c7:bf:07:42:35:a0:48:87:da:d8:a1:02:2e:39:5b:45:ef:79:1d:3e:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

dc:7f:be:ee:70:52:ba:ad:5c:69:dd:8c:b2:8a:2d:b4:3b:72:12:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-conio-l1-1-0.pdb

api-ms-win-crt-convert-l1-1-0.dll

SHA256 b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
MD5 9ddea3cc96e0fdd3443cc60d649931b3
SHA1 af3cb7036318a8427f20b8561079e279119dca0e
SHA512 1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162
SSDEEP 384:FuyhW1hWF4wm0GftpBjErIm3StlndaYhpFeD:4cFViUIbi
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8d:a7:76:c4:c6:f5:cd:7a:4c:9e:0f:01:75:35:55:73:32:a5:1f:21:95:96:82:5e:96:32:9c:59:13:5a:8f:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

49:f8:c7:c9:dc:a2:e5:42:6d:03:6f:5d:76:82:cf:72:ff:d2:8e:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-convert-l1-1-0.pdb

__toascii _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _ecvt _ecvt_s _fcvt _fcvt_s _gcvt _gcvt_s _i64toa _i64toa_s _i64tow _i64tow_s _itoa _itoa_s _itow _itow_s _ltoa _ltoa_s _ltow _ltow_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wctomb_l _wctomb_s_l _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l atof atoi atol atoll btowc c16rtomb c32rtomb mbrtoc16 mbrtoc32 mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc strtod strtof strtoimax strtol strtold strtoll strtoul strtoull strtoumax wcrtomb wcrtomb_s wcsrtombs wcsrtombs_s wcstod wcstof wcstoimax wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wctob wctomb wctomb_s wctrans

api-ms-win-crt-environment-l1-1-0.dll

SHA256 56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
MD5 39325e5f023eb564c87d30f7e06dff23
SHA1 03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
SHA512 087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085
SSDEEP 192:4rW1hWiSu7jCjdks/nGfe4pBjSYC69poCxW5RKTt3E2sVWQ4GWmEsSC9qnajuZDW:AW1hW6am0GftpBjtBQm3SzSKlUKTT
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

28:c1:a4:2b:1d:91:ea:be:3a:d3:3f:5c:90:ea:09:b4:05:5f:5a:c5:92:7f:1d:e5:82:9c:8b:3a:b3:ce:5d:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

e3:ab:0a:72:3e:e1:d0:34:5f:22:81:e5:aa:fb:a5:b4:12:e6:93:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-environment-l1-1-0.pdb

api-ms-win-crt-filesystem-l1-1-0.dll

SHA256 ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
MD5 228c6bbe1bce84315e4927392a3baee5
SHA1 ba274aa567ad1ec663a2f9284af2e3cb232698fb
SHA512 37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab
SSDEEP 384:Cq6nWm5CZW1hW9YBm0GftpBjVem3SuPvlg+0Pd:T6nWm5CIhViDeKPmd
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4f:bb:d0:ab:a0:f5:83:f3:48:6d:e9:4a:b5:28:2f:6e:35:8d:ce:a2:e8:b8:f0:f1:17:80:78:f5:a8:86:a9:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

01:38:64:ee:29:b6:ac:ca:90:af:a5:85:c6:5f:83:b9:16:59:07:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-filesystem-l1-1-0.pdb

api-ms-win-crt-heap-l1-1-0.dll

SHA256 675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee
MD5 1776a2b85378b27825cf5e5a3a132d9a
SHA1 626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df
SHA512 541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348
SSDEEP 384:XY3eBW1hWqvm0GftpBjtzsxm3SKulndaYhp6s:zQzViATv
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:ef:42:8b:ca:b7:de:34:29:47:8c:f4:03:4c:b1:bf:45:5b:d9:0f:5f:8a:e9:30:47:eb:83:ac:dc:59:a2:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

df:a8:71:5e:de:27:0f:ab:bc:5f:46:c2:d2:b8:8b:bb:64:45:ce:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-heap-l1-1-0.pdb

api-ms-win-crt-locale-l1-1-0.dll

SHA256 8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
MD5 034379bcea45eb99db8cdfeacbc5e281
SHA1 bbf93d82e7e306e827efeb9612e8eab2b760e2b7
SHA512 7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256
SSDEEP 192:lW1hWi6+49Cjdks/nGfe4pBjSY38yMsW5RKTt3E2sVWQ4GWbGBfqnajE49dRX3tK:lW1hWa4wm0GftpBjlWm3S7dlPptZA
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c4:9e:7c:72:02:bd:96:0b:21:f1:d5:4b:83:e8:0a:83:ee:1b:ad:36:75:78:a1:cc:50:6e:70:b5:77:2e:5c:b7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

55:40:1f:9c:58:bd:a7:92:7e:cc:54:e0:c5:0c:36:47:a3:91:9a:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-locale-l1-1-0.pdb

api-ms-win-crt-math-l1-1-0.dll

SHA256 39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
MD5 8da414c3524a869e5679c0678d1640c1
SHA1 60cf28792c68e9894878c31b323e68feb4676865
SHA512 6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa
SSDEEP 384:jOTEmbM4Oe5grykfIgTmLmW1hWSsngm0GftpBjGm3SAlD16hX:lEMq5grxfIndCngVis5
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b4:81:a9:e2:bf:77:48:ad:a2:83:51:23:75:b7:75:be:1d:a6:6a:78:f5:17:6a:b4:45:b0:03:89:ec:c9:a8:d2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

4a:5d:3e:6b:77:5b:7a:3e:d6:e5:62:4f:2e:9f:4c:b0:f8:3f:d1:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-math-l1-1-0.pdb

_CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _Cbuild _Cmulcc _Cmulcr _FCbuild _FCmulcc _FCmulcr _LCbuild _LCmulcc _LCmulcr __libm_sse2_acos __libm_sse2_acosf __libm_sse2_asin __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_atanf __libm_sse2_cos __libm_sse2_cosf __libm_sse2_exp __libm_sse2_expf __libm_sse2_log __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_logf __libm_sse2_pow __libm_sse2_powf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_tan __libm_sse2_tanf __setusermatherr _cabs _chgsign _chgsignf _copysign _copysignf _d_int _dclass _dexp _dlog _dnorm _dpcomp _dpoly _dscale _dsign _dsin _dtest _dunscale _except1 _fd_int _fdclass _fdexp _fdlog _fdnorm _fdopen _fdpcomp _fdpoly _fdscale _fdsign _fdsin _fdtest _fdunscale _finite _fpclass _ftol _hypot _hypotf _isnan _j0 _j1 _jn _ld_int _ldclass _ldexp _ldlog _ldpcomp _ldpoly _ldscale _ldsign _ldsin _ldtest _ldunscale _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _logb _nextafter _scalb _set_SSE2_enable _y0 _y1 _yn acos acosh acoshf acoshl asin asinh asinhf asinhl atan atan2 atanh atanhf atanhl cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil cexp cexpf cexpl cimag cimagf cimagl clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosh cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl erf erfc erfcf erfcl erff erfl exp exp2 exp2f exp2l expm1 expm1f expm1l fabs fdim fdimf fdiml floor fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod frexp hypot ilogb ilogbf ilogbl ldexp lgamma lgammaf lgammal llrint llrintf llrintl llround llroundf llroundl log log10 log1p log1pf log1pl log2 log2f log2l logb logbf logbl lrint lrintf lrintl lround lroundf lroundl modf nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml pow powf remainder remainderf remainderl remquo remquof remquol rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl sin sinh sqrt tan tanh tgamma tgammaf tgammal trunc truncf truncl

api-ms-win-crt-multibyte-l1-1-0.dll

SHA256 a6b83b764555d517216e0e34c4945f7a7501c1b7a25308d8f85551fe353f9c15
MD5 19d7f2d6424c98c45702489a375d9e17
SHA1 310bc4ed49492383e7c669ac9145bda2956c7564
SHA512 01c09edef90c60c9e6cdabff918f15afc9b728d6671947898ce8848e3d102f300f3fb4246af0ac9c6f57b3b85b24832d7b40452358636125b61eb89567d3b17e
SSDEEP 384:2y+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWOXRm0GftpBjVm3SKlDCEIy:2ZKrZPmIHJI6abVi/Q1Iy
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d8:52:c0:6f:2f:9c:98:18:86:30:8a:4f:cc:7b:47:bb:64:84:85:b0:d0:fd:f3:bd:51:04:4b:16:74:d1:82:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

c7:51:bf:93:d9:26:4a:9c:a3:a1:6e:e4:b6:51:e0:90:12:1b:56:07

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-multibyte-l1-1-0.pdb

__p__mbcasemap __p__mbctype _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsdup _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l

api-ms-win-crt-private-l1-1-0.dll

SHA256 dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7
MD5 3d139f57ed79d2c788e422ca26950446
SHA1 788e4fb5d1f46b0f1802761d0ae3addb8611c238
SHA512 12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765
SSDEEP 1536:g0DjXDe5c4bFE2Jy2cvxXWpD9d3334BkZnVPL9VG:XjDe5c4bFE2Jy2cvxXWpD9d3334BkZnI
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

17:e8:a5:1f:4e:4f:ea:b3:1a:b1:27:a3:ba:d9:af:1d:b5:79:ea:1e:70:b1:d5:0d:86:a6:69:9b:bd:b7:68:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

24:d4:41:f4:86:c6:03:42:bf:9f:07:10:9c:5d:60:bb:45:58:ff:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-private-l1-1-0.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __dcrt_get_wide_environment_from_os __dcrt_initial_narrow_environment __intrinsic_abnormal_termination __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __unDName __unDNameEx __uncaught_exception __uncaught_exceptions _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _o__CIacos _o__CIasin _o__CIatan _o__CIatan2 _o__CIcos _o__CIcosh _o__CIexp _o__CIfmod _o__CIlog _o__CIlog10 _o__CIpow _o__CIsin _o__CIsinh _o__CIsqrt _o__CItan _o__CItanh _o__Getdays _o__Getmonths _o__Gettnames _o__Strftime _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__Wcsftime _o____lc_codepage_func _o____lc_collate_cp_func _o____lc_locale_name_func _o____mb_cur_max_func _o___acrt_iob_func _o___conio_common_vcprintf _o___conio_common_vcprintf_p _o___conio_common_vcprintf_s _o___conio_common_vcscanf _o___conio_common_vcwprintf _o___conio_common_vcwprintf_p _o___conio_common_vcwprintf_s _o___conio_common_vcwscanf _o___daylight _o___dstbias _o___fpe_flt_rounds _o___libm_sse2_acos _o___libm_sse2_acosf _o___libm_sse2_asin _o___libm_sse2_asinf _o___libm_sse2_atan _o___libm_sse2_atan2 _o___libm_sse2_atanf _o___libm_sse2_cos _o___libm_sse2_cosf _o___libm_sse2_exp _o___libm_sse2_expf _o___libm_sse2_log _o___libm_sse2_log10 _o___libm_sse2_log10f _o___libm_sse2_logf _o___libm_sse2_pow _o___libm_sse2_powf _o___libm_sse2_sin _o___libm_sse2_sinf _o___libm_sse2_tan _o___libm_sse2_tanf _o___p___argc _o___p___argv _o___p___wargv _o___p__acmdln _o___p__commode _o___p__environ _o___p__fmode _o___p__mbcasemap _o___p__mbctype _o___p__pgmptr _o___p__wcmdln _o___p__wenviron _o___p__wpgmptr _o___pctype_func _o___pwctype_func _o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___std_type_info_name _o___stdio_common_vfprintf _o___stdio_common_vfprintf_p _o___stdio_common_vfprintf_s _o___stdio_common_vfscanf _o___stdio_common_vfwprintf _o___stdio_common_vfwprintf_p _o___stdio_common_vfwprintf_s _o___stdio_common_vfwscanf _o___stdio_common_vsnprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsprintf_p _o___stdio_common_vsprintf_s _o___stdio_common_vsscanf _o___stdio_common_vswprintf _o___stdio_common_vswprintf_p _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o___timezone _o___tzname _o___wcserror _o__access _o__access_s _o__aligned_free _o__aligned_malloc _o__aligned_msize _o__aligned_offset_malloc _o__aligned_offset_realloc _o__aligned_offset_recalloc _o__aligned_realloc _o__aligned_recalloc _o__atodbl _o__atodbl_l _o__atof_l _o__atoflt _o__atoflt_l _o__atoi64 _o__atoi64_l _o__atoi_l _o__atol_l _o__atoldbl _o__atoldbl_l _o__atoll_l _o__beep _o__beginthread _o__beginthreadex _o__cabs _o__callnewh _o__calloc_base _o__cexit _o__cgets _o__cgets_s _o__cgetws _o__cgetws_s _o__chdir _o__chdrive _o__chmod _o__chsize _o__chsize_s _o__close _o__commit _o__configthreadlocale _o__configure_narrow_argv _o__configure_wide_argv _o__controlfp_s _o__cputs _o__cputws _o__creat _o__create_locale _o__crt_atexit _o__ctime32_s _o__ctime64_s _o__cwait _o__d_int _o__dclass _o__difftime32 _o__difftime64 _o__dlog _o__dnorm _o__dpcomp _o__dpoly _o__dscale _o__dsign _o__dsin _o__dtest _o__dunscale _o__dup _o__dup2 _o__dupenv_s _o__ecvt _o__ecvt_s _o__endthread _o__endthreadex _o__eof _o__errno _o__except1 _o__execute_onexit_table _o__execv _o__execve _o__execvp _o__execvpe _o__exit _o__expand _o__fclose_nolock _o__fcloseall _o__fcvt _o__fcvt_s _o__fd_int _o__fdclass _o__fdexp _o__fdlog _o__fdopen _o__fdpcomp _o__fdpoly _o__fdscale _o__fdsign _o__fdsin _o__fflush_nolock _o__fgetc_nolock _o__fgetchar _o__fgetwc_nolock _o__fgetwchar _o__filelength _o__filelengthi64 _o__fileno _o__findclose _o__findfirst32 _o__findfirst32i64 _o__findfirst64 _o__findfirst64i32 _o__findnext32 _o__findnext32i64 _o__findnext64 _o__findnext64i32 _o__flushall _o__fpclass _o__fputc_nolock _o__fputchar _o__fputwc_nolock _o__fputwchar _o__fread_nolock _o__fread_nolock_s _o__free_base _o__free_locale _o__fseek_nolock _o__fseeki64 _o__fseeki64_nolock _o__fsopen _o__fstat32 _o__fstat32i64 _o__fstat64 _o__fstat64i32 _o__ftell_nolock _o__ftelli64 _o__ftelli64_nolock _o__ftime32 _o__ftime32_s _o__ftime64 _o__ftime64_s _o__fullpath _o__futime32 _o__futime64 _o__fwrite_nolock _o__gcvt _o__gcvt_s _o__get_daylight _o__get_doserrno _o__get_dstbias _o__get_errno _o__get_fmode _o__get_heap_handle _o__get_initial_narrow_environment _o__get_initial_wide_environment _o__get_invalid_parameter_handler _o__get_narrow_winmain_command_line _o__get_osfhandle _o__get_pgmptr _o__get_stream_buffer_pointers _o__get_terminate _o__get_thread_local_invalid_parameter_handler _o__get_timezone _o__get_tzname _o__get_wide_winmain_command_line _o__get_wpgmptr _o__getc_nolock _o__getch _o__getch_nolock _o__getche _o__getche_nolock _o__getcwd _o__getdcwd _o__getdiskfree _o__getdllprocaddr _o__getdrive _o__getdrives _o__getmbcp _o__getsystime _o__getw _o__getwc_nolock _o__getwch _o__getwch_nolock _o__getwche _o__getwche_nolock _o__getws _o__getws_s _o__gmtime32 _o__gmtime32_s _o__gmtime64 _o__gmtime64_s _o__heapchk _o__heapmin _o__hypot _o__hypotf _o__i64toa _o__i64toa_s _o__i64tow _o__i64tow_s _o__initialize_narrow_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__isatty _o__isctype _o__isctype_l _o__isleadbyte_l _o__ismbbalnum _o__ismbbalnum_l _o__ismbbalpha _o__ismbbalpha_l _o__ismbbblank _o__ismbbblank_l _o__ismbbgraph _o__ismbbgraph_l _o__ismbbkalnum _o__ismbbkalnum_l _o__ismbbkana _o__ismbbkana_l _o__ismbbkprint _o__ismbbkprint_l _o__ismbbkpunct _o__ismbbkpunct_l _o__ismbblead _o__ismbblead_l _o__ismbbprint _o__ismbbprint_l _o__ismbbpunct _o__ismbbpunct_l _o__ismbbtrail _o__ismbbtrail_l _o__ismbcalnum _o__ismbcalnum_l _o__ismbcalpha _o__ismbcalpha_l _o__ismbcblank _o__ismbcblank_l _o__ismbcdigit _o__ismbcdigit_l _o__ismbcgraph _o__ismbcgraph_l _o__ismbchira _o__ismbchira_l _o__ismbckata _o__ismbckata_l _o__ismbcl0 _o__ismbcl0_l _o__ismbcl1 _o__ismbcl1_l _o__ismbcl2 _o__ismbcl2_l _o__ismbclegal _o__ismbclegal_l _o__ismbclower _o__ismbclower_l _o__ismbcprint _o__ismbcprint_l _o__ismbcpunct _o__ismbcpunct_l _o__ismbcspace _o__ismbcspace_l _o__ismbcsymbol _o__ismbcsymbol_l _o__ismbcupper _o__ismbcupper_l _o__ismbslead _o__ismbslead_l _o__ismbstrail _o__ismbstrail_l _o__iswctype_l _o__itoa _o__itoa_s _o__itow _o__itow_s _o__j0 _o__j1 _o__jn _o__kbhit _o__ld_int _o__ldclass _o__ldexp _o__ldlog _o__ldpcomp _o__ldpoly _o__ldscale _o__ldsign _o__ldsin _o__ldtest _o__ldunscale _o__lfind _o__lfind_s _o__libm_sse2_acos_precise _o__libm_sse2_asin_precise _o__libm_sse2_atan_precise _o__libm_sse2_cos_precise _o__libm_sse2_exp_precise _o__libm_sse2_log10_precise _o__libm_sse2_log_precise _o__libm_sse2_pow_precise _o__libm_sse2_sin_precise _o__libm_sse2_sqrt_precise _o__libm_sse2_tan_precise _o__loaddll _o__localtime32 _o__localtime32_s _o__localtime64 _o__localtime64_s _o__lock_file _o__locking _o__logb _o__lsearch _o__lsearch_s _o__lseek _o__lseeki64 _o__ltoa _o__ltoa_s _o__ltow _o__ltow_s _o__makepath _o__makepath_s _o__malloc_base _o__mbbtombc _o__mbbtombc_l _o__mbbtype _o__mbbtype_l _o__mbccpy _o__mbccpy_l _o__mbccpy_s _o__mbccpy_s_l _o__mbcjistojms _o__mbcjistojms_l _o__mbcjmstojis _o__mbcjmstojis_l _o__mbclen _o__mbclen_l _o__mbctohira _o__mbctohira_l _o__mbctokata _o__mbctokata_l _o__mbctolower _o__mbctolower_l _o__mbctombb _o__mbctombb_l _o__mbctoupper _o__mbctoupper_l _o__mblen_l _o__mbsbtype _o__mbsbtype_l _o__mbscat_s _o__mbscat_s_l _o__mbschr _o__mbschr_l _o__mbscmp _o__mbscmp_l _o__mbscoll _o__mbscoll_l _o__mbscpy_s _o__mbscpy_s_l _o__mbscspn _o__mbscspn_l _o__mbsdec _o__mbsdec_l _o__mbsicmp _o__mbsicmp_l _o__mbsicoll _o__mbsicoll_l _o__mbsinc _o__mbsinc_l _o__mbslen _o__mbslen_l _o__mbslwr _o__mbslwr_l _o__mbslwr_s _o__mbslwr_s_l _o__mbsnbcat _o__mbsnbcat_l _o__mbsnbcat_s _o__mbsnbcat_s_l _o__mbsnbcmp _o__mbsnbcmp_l _o__mbsnbcnt _o__mbsnbcnt_l _o__mbsnbcoll _o__mbsnbcoll_l _o__mbsnbcpy _o__mbsnbcpy_l _o__mbsnbcpy_s _o__mbsnbcpy_s_l _o__mbsnbicmp _o__mbsnbicmp_l _o__mbsnbicoll _o__mbsnbicoll_l _o__mbsnbset _o__mbsnbset_l _o__mbsnbset_s _o__mbsnbset_s_l _o__mbsncat _o__mbsncat_l _o__mbsncat_s _o__mbsncat_s_l _o__mbsnccnt _o__mbsnccnt_l _o__mbsncmp _o__mbsncmp_l _o__mbsncoll _o__mbsncoll_l _o__mbsncpy _o__mbsncpy_l _o__mbsncpy_s _o__mbsncpy_s_l _o__mbsnextc _o__mbsnextc_l _o__mbsnicmp _o__mbsnicmp_l _o__mbsnicoll _o__mbsnicoll_l _o__mbsninc _o__mbsninc_l _o__mbsnlen _o__mbsnlen_l _o__mbsnset _o__mbsnset_l _o__mbsnset_s _o__mbsnset_s_l _o__mbspbrk _o__mbspbrk_l _o__mbsrchr _o__mbsrchr_l _o__mbsrev _o__mbsrev_l _o__mbsset _o__mbsset_l _o__mbsset_s _o__mbsset_s_l _o__mbsspn _o__mbsspn_l _o__mbsspnp _o__mbsspnp_l _o__mbsstr _o__mbsstr_l _o__mbstok _o__mbstok_l _o__mbstok_s _o__mbstok_s_l _o__mbstowcs_l _o__mbstowcs_s_l _o__mbstrlen _o__mbstrlen_l _o__mbstrnlen _o__mbstrnlen_l _o__mbsupr _o__mbsupr_l _o__mbsupr_s _o__mbsupr_s_l _o__mbtowc_l _o__memicmp _o__memicmp_l _o__mkdir _o__mkgmtime32 _o__mkgmtime64 _o__mktemp _o__mktemp_s _o__mktime32 _o__mktime64 _o__msize _o__nextafter _o__open_osfhandle _o__pclose _o__pipe _o__popen _o__purecall _o__putc_nolock _o__putch _o__putch_nolock _o__putenv _o__putenv_s _o__putw _o__putwc_nolock _o__putwch _o__putwch_nolock _o__putws _o__read _o__realloc_base _o__recalloc _o__register_onexit_function _o__resetstkoflw _o__rmdir _o__rmtmp _o__scalb _o__searchenv _o__searchenv_s _o__seh_filter_dll _o__seh_filter_exe _o__set_abort_behavior _o__set_app_type _o__set_doserrno _o__set_errno _o__set_fmode _o__set_invalid_parameter_handler _o__set_new_handler _o__set_new_mode _o__set_thread_local_invalid_parameter_handler _o__seterrormode _o__setmbcp _o__setmode _o__setsystime _o__sleep _o__sopen _o__sopen_dispatch _o__sopen_s _o__spawnv _o__spawnve _o__spawnvp _o__spawnvpe _o__splitpath _o__splitpath_s _o__stat32 _o__stat32i64 _o__stat64 _o__stat64i32 _o__strcoll_l _o__strdate _o__strdate_s _o__strdup _o__strerror _o__strerror_s _o__strftime_l _o__stricmp _o__stricmp_l _o__stricoll _o__stricoll_l _o__strlwr _o__strlwr_l _o__strlwr_s _o__strlwr_s_l _o__strncoll _o__strncoll_l _o__strnicmp _o__strnicmp_l _o__strnicoll _o__strnicoll_l _o__strnset_s _o__strset_s _o__strtime _o__strtime_s _o__strtod_l _o__strtof_l _o__strtoi64 _o__strtoi64_l _o__strtol_l _o__strtold_l _o__strtoll_l _o__strtoui64 _o__strtoui64_l _o__strtoul_l _o__strtoull_l _o__strupr _o__strupr_l _o__strupr_s _o__strupr_s_l _o__strxfrm_l _o__swab _o__tell _o__telli64 _o__timespec32_get _o__timespec64_get _o__tolower _o__tolower_l _o__toupper _o__toupper_l _o__towlower_l _o__towupper_l _o__tzset _o__ui64toa _o__ui64toa_s _o__ui64tow _o__ui64tow_s _o__ultoa _o__ultoa_s _o__ultow _o__ultow_s _o__umask _o__umask_s _o__ungetc_nolock _o__ungetch _o__ungetch_nolock _o__ungetwc_nolock _o__ungetwch _o__ungetwch_nolock _o__unlink _o__unloaddll _o__unlock_file _o__utime32 _o__utime64 _o__waccess _o__waccess_s _o__wasctime _o__wasctime_s _o__wchdir _o__wchmod _o__wcreat _o__wcreate_locale _o__wcscoll_l _o__wcsdup _o__wcserror _o__wcserror_s _o__wcsftime_l _o__wcsicmp _o__wcsicmp_l _o__wcsicoll _o__wcsicoll_l _o__wcslwr _o__wcslwr_l _o__wcslwr_s _o__wcslwr_s_l _o__wcsncoll _o__wcsncoll_l _o__wcsnicmp _o__wcsnicmp_l _o__wcsnicoll _o__wcsnicoll_l _o__wcsnset _o__wcsnset_s _o__wcsset _o__wcsset_s _o__wcstod_l _o__wcstof_l _o__wcstoi64 _o__wcstoi64_l _o__wcstol_l _o__wcstold_l _o__wcstoll_l _o__wcstombs_l _o__wcstombs_s_l _o__wcstoui64 _o__wcstoui64_l _o__wcstoul_l _o__wcstoull_l _o__wcsupr _o__wcsupr_l _o__wcsupr_s _o__wcsupr_s_l _o__wcsxfrm_l _o__wctime32 _o__wctime32_s _o__wctime64 _o__wctime64_s _o__wctomb_l _o__wctomb_s_l _o__wdupenv_s _o__wexecv _o__wexecve _o__wexecvp _o__wexecvpe _o__wfdopen _o__wfindfirst32 _o__wfindfirst32i64 _o__wfindfirst64 _o__wfindfirst64i32 _o__wfindnext32 _o__wfindnext32i64 _o__wfindnext64 _o__wfindnext64i32 _o__wfopen _o__wfopen_s _o__wfreopen _o__wfreopen_s _o__wfsopen _o__wfullpath _o__wgetcwd _o__wgetdcwd _o__wgetenv _o__wgetenv_s _o__wmakepath _o__wmakepath_s _o__wmkdir _o__wmktemp _o__wmktemp_s _o__wperror _o__wpopen _o__wputenv _o__wputenv_s _o__wremove _o__wrename _o__write _o__wrmdir _o__wsearchenv _o__wsearchenv_s _o__wsetlocale _o__wsopen_dispatch _o__wsopen_s _o__wspawnv _o__wspawnve _o__wspawnvp _o__wspawnvpe _o__wsplitpath _o__wsplitpath_s _o__wstat32 _o__wstat32i64 _o__wstat64 _o__wstat64i32 _o__wstrdate _o__wstrdate_s _o__wstrtime _o__wstrtime_s _o__wsystem _o__wtmpnam_s _o__wtof _o__wtof_l _o__wtoi _o__wtoi64 _o__wtoi64_l _o__wtoi_l _o__wtol _o__wtol_l _o__wtoll _o__wtoll_l _o__wunlink _o__wutime32 _o__wutime64 _o__y0 _o__y1 _o__yn _o_abort _o_acos _o_acosh _o_acoshf _o_acoshl _o_asctime _o_asctime_s _o_asin _o_asinh _o_asinhf _o_asinhl _o_atan _o_atan2 _o_atanh _o_atanhf _o_atanhl _o_atof _o_atoi _o_atol _o_atoll _o_bsearch _o_bsearch_s _o_btowc _o_calloc _o_cbrt _o_cbrtf _o_ceil _o_clearerr _o_clearerr_s _o_cos _o_cosh _o_erf _o_erfc _o_erfcf _o_erfcl _o_erff _o_erfl _o_exit _o_exp _o_exp2 _o_exp2f _o_exp2l _o_fabs _o_fclose _o_feof _o_ferror _o_fflush _o_fgetc _o_fgetpos _o_fgets _o_fgetwc _o_fgetws _o_floor _o_fma _o_fmaf _o_fmal _o_fmod _o_fopen _o_fopen_s _o_fputc _o_fputs _o_fputwc _o_fputws _o_fread _o_fread_s _o_free _o_freopen _o_freopen_s _o_frexp _o_fseek _o_fsetpos _o_ftell _o_fwrite _o_getc _o_getchar _o_getenv _o_getenv_s _o_gets _o_gets_s _o_getwc _o_getwchar _o_hypot _o_is_wctype _o_isalnum _o_isalpha _o_isblank _o_iscntrl _o_isdigit _o_isgraph _o_isleadbyte _o_islower _o_isprint _o_ispunct _o_isspace _o_isupper _o_iswalnum _o_iswalpha _o_iswascii _o_iswblank _o_iswcntrl _o_iswctype _o_iswdigit _o_iswgraph _o_iswlower _o_iswprint _o_iswpunct _o_iswspace _o_iswupper _o_iswxdigit _o_isxdigit _o_ldexp _o_lgamma _o_lgammaf _o_lgammal _o_llrint _o_llrintf _o_llrintl _o_llround _o_llroundf _o_llroundl _o_localeconv _o_log _o_log10 _o_log1p _o_log1pf _o_log1pl _o_log2 _o_log2f _o_log2l _o_logb _o_logbf _o_logbl _o_lrint _o_lrintf _o_lrintl _o_lround _o_lroundf _o_lroundl _o_malloc _o_mblen _o_mbrlen _o_mbrtoc16 _o_mbrtoc32 _o_mbrtowc _o_mbsrtowcs _o_mbsrtowcs_s _o_mbstowcs _o_mbstowcs_s _o_mbtowc _o_memcpy_s _o_modf _o_nan _o_nanf _o_nanl _o_nearbyint _o_nearbyintf _o_nearbyintl _o_nextafter _o_nextafterf _o_nextafterl _o_nexttoward _o_nexttowardf _o_nexttowardl _o_pow _o_powf _o_putc _o_putchar _o_puts _o_putwc _o_putwchar _o_qsort _o_qsort_s _o_raise _o_rand _o_rand_s _o_realloc _o_remainder _o_remainderf _o_remainderl _o_remove _o_remquo _o_remquof _o_remquol _o_rename _o_rewind _o_rint _o_rintf _o_rintl _o_round _o_roundf _o_roundl _o_scalbln _o_scalblnf _o_scalblnl _o_scalbn _o_scalbnf _o_scalbnl _o_set_terminate _o_setbuf _o_setlocale _o_setvbuf _o_sin _o_sinh _o_sqrt _o_srand _o_strcat_s _o_strcoll _o_strcpy_s _o_strerror _o_strerror_s _o_strftime _o_strncat_s _o_strncpy_s _o_strtod _o_strtof _o_strtok _o_strtok_s _o_strtol _o_strtold _o_strtoll _o_strtoul _o_strtoull _o_system _o_tan _o_tanh _o_terminate _o_tgamma _o_tgammaf _o_tgammal _o_tmpfile_s _o_tmpnam_s _o_tolower _o_toupper _o_towlower _o_towupper _o_ungetc _o_ungetwc _o_wcrtomb _o_wcrtomb_s _o_wcscat_s _o_wcscoll _o_wcscpy _o_wcscpy_s _o_wcsftime _o_wcsncat_s _o_wcsncpy_s _o_wcsrtombs _o_wcsrtombs_s _o_wcstod _o_wcstof _o_wcstok _o_wcstok_s _o_wcstol _o_wcstold _o_wcstoll _o_wcstombs _o_wcstombs_s _o_wcstoul _o_wcstoull _o_wctob _o_wctomb _o_wctomb_s _o_wmemcpy_s _o_wmemmove_s _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

api-ms-win-crt-process-l1-1-0.dll

SHA256 707c9a384440d0b2d067fc0335273f8851b02c3114842e17df9c54127910d7fb
MD5 9d3d6f938c8672a12aea03f85d5330de
SHA1 6a7d6e84527eaf54d6f78dd1a5f20503e766a66c
SHA512 0e1681b16cd9af116bcc5c6b4284c1203b33febb197d1d4ab8a649962c0e807af9258bde91c86727910624196948e976741411843dd841616337ea93a27de7cb
SSDEEP 192:hRQqjd7hW1hWif+49Cjdks/nGfe4pBjSYr+c24QLW5RKTt3E2sVWQ4GWw899qnaP:hKwW1hWZ4wm0GftpBjh24Jm3SwlUKTw2
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

69:69:7b:ab:9a:ae:0c:c5:99:03:98:6e:77:1c:b4:69:99:f6:4e:22:88:ec:f0:57:6c:07:86:4a:90:1a:41:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

3c:c9:27:de:6e:c2:16:2c:63:ea:3d:66:f4:ba:30:5f:e8:f5:3b:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-process-l1-1-0.pdb

api-ms-win-crt-runtime-l1-1-0.dll

SHA256 1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
MD5 fb0ca6cbfff46be87ad729a1c4fde138
SHA1 2c302d1c535d5c40f31c3a75393118b40e1b2af9
SHA512 99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83
SSDEEP 384:Lb7hrKkW1hW54wm0GftpBjGOm3SdWlmTwhctW:LbNrKn8FVinhZW
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0d:da:f7:91:ec:8c:d6:bc:9c:d3:ca:0b:d3:34:13:64:97:35:9e:df:bf:b6:c0:ad:59:ce:3e:f1:fe:f3:42:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

38:d0:bb:ce:4f:3b:91:fe:01:52:6f:59:bb:69:68:62:c4:4a:78:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-runtime-l1-1-0.pdb

_Exit __control87_2 __doserrno __fpe_flt_rounds __fpecode __p___argc __p___argv __p___wargv __p__acmdln __p__pgmptr __p__wcmdln __p__wpgmptr __pxcptinfoptrs __sys_errlist __sys_nerr __threadhandle __threadid __wcserror __wcserror_s _assert _beginthread _beginthreadex _c_exit _cexit _clearfp _configure_narrow_argv _configure_wide_argv _control87 _controlfp _controlfp_s _crt_at_quick_exit _crt_atexit _crt_debugger_hook _endthread _endthreadex _errno _execute_onexit_table _exit _fpieee_flt _fpreset _get_doserrno _get_errno _get_initial_narrow_environment _get_initial_wide_environment _get_invalid_parameter_handler _get_narrow_winmain_command_line _get_pgmptr _get_terminate _get_thread_local_invalid_parameter_handler _get_wide_winmain_command_line _get_wpgmptr _getdllprocaddr _getpid _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _query_app_type _register_onexit_function _register_thread_local_exe_atexit_callback _resetstkoflw _seh_filter_dll _seh_filter_exe _set_abort_behavior _set_app_type _set_controlfp _set_doserrno _set_errno _set_error_mode _set_invalid_parameter_handler _set_new_handler _set_thread_local_invalid_parameter_handler _seterrormode _sleep _statusfp _statusfp2 _strerror _strerror_s _wassert _wcserror _wcserror_s _wperror _wsystem abort exit feclearexcept fegetenv fegetexceptflag fegetround feholdexcept fesetenv fesetexceptflag fesetround fetestexcept perror quick_exit raise set_terminate signal strerror strerror_s system terminate

api-ms-win-crt-stdio-l1-1-0.dll

SHA256 7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5
MD5 d5166ab3034f0e1aa679bfa1907e5844
SHA1 851dd640cb34177c43b5f47b218a686c09fa6b4c
SHA512 8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e
SSDEEP 384:/ZpFVhHW1hWxgYBm0GftpBjMm3SNlndaYhpn3p:boEVi6DBp
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

06:6a:c5:48:de:6e:e8:ec:f5:6d:b2:e4:7d:c8:0f:e8:50:a7:f5:6b:6e:95:33:49:2d:a2:ba:7c:d7:ae:f3:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

cd:d6:f2:d2:ca:df:e3:a6:28:86:42:e0:c0:2c:cc:ac:55:18:39:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-stdio-l1-1-0.pdb

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfprintf_p __stdio_common_vfprintf_s __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vfwprintf_p __stdio_common_vfwprintf_s __stdio_common_vfwscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_p __stdio_common_vswprintf_s __stdio_common_vswscanf _chsize _chsize_s _close _commit _creat _dup _dup2 _eof _fclose_nolock _fcloseall _fflush_nolock _fgetc_nolock _fgetchar _fgetwc_nolock _fgetwchar _filelength _filelengthi64 _fileno _flushall _fputc_nolock _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _ftell_nolock _ftelli64 _ftelli64_nolock _fwrite_nolock _get_fmode _get_osfhandle _get_printf_count_output _get_stream_buffer_pointers _getc_nolock _getcwd _getdcwd _getmaxstdio _getw _getwc_nolock _getws _getws_s _isatty _kbhit _locking _lseek _lseeki64 _mktemp _mktemp_s _open _open_osfhandle _pclose _pipe _popen _putc_nolock _putw _putwc_nolock _putws _read _rmtmp _set_fmode _set_printf_count_output _setmaxstdio _setmode _sopen _sopen_dispatch _sopen_s _tell _telli64 _tempnam _ungetc_nolock _ungetwc_nolock _wcreat _wfdopen _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wmktemp _wmktemp_s _wopen _wpopen _write _wsopen _wsopen_dispatch _wsopen_s _wtempnam _wtmpnam _wtmpnam_s clearerr clearerr_s fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws fopen fopen_s fputc fputs fputwc fputws fread fread_s freopen freopen_s fseek fsetpos ftell fwrite getc getchar gets gets_s getwc getwchar putc putchar puts putwc putwchar rewind setbuf setvbuf tmpfile tmpfile_s tmpnam tmpnam_s ungetc ungetwc

api-ms-win-crt-string-l1-1-0.dll

SHA256 73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
MD5 ad99c2362f64cde7756b16f9a016a60f
SHA1 07c9a78ee658bfa81db61dab039cffc9145cc6cb
SHA512 9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7
SSDEEP 384:jiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWS4wm0GftpBjwwO5m3S9lJrm:j6S5yguNvZ5VQgx3SbwA71IkFhbFViWs
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4a:f7:b2:a8:7c:0d:32:af:2c:96:ea:a5:fe:83:44:27:53:a1:05:26:3b:78:e6:6e:92:ce:a4:2c:39:01:4b:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

15:fc:7d:e6:b7:e4:21:f5:f7:05:fb:44:ff:49:64:30:bf:80:c9:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-string-l1-1-0.pdb

__isascii __iscsym __iscsymf __iswcsym __iswcsymf __strncnt __wcsncnt _isalnum_l _isalpha_l _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _memccpy _memicmp _memicmp_l _strcoll_l _strdup _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsdup _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctype is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit mblen mbrlen memcpy_s memmove_s memset strcat strcat_s strcmp strcoll strcpy strcpy_s strcspn strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strspn strtok strtok_s strxfrm tolower toupper towctrans towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcscspn wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsspn wcstok wcstok_s wcsxfrm wctype wmemcpy_s wmemmove_s

api-ms-win-crt-time-l1-1-0.dll

SHA256 4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
MD5 9b79fda359a269c63dcac69b2c81caa4
SHA1 a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb
SHA512 e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541
SSDEEP 384:iUW1hWQ4wm0GftpBjddQxm3SLDlD16h1S:eRFViexn1
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:78:0a:48:f4:90:dc:4c:3c:d4:1c:48:df:dc:fe:5d:ff:e8:28:d6:07:53:5e:c7:ef:a4:6d:6f:ed:cb:95:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

a2:ab:93:be:71:e1:28:d5:c7:c0:87:3a:24:66:31:da:b0:d7:78:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-time-l1-1-0.pdb

api-ms-win-crt-utility-l1-1-0.dll

SHA256 7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
MD5 70e9104e743069b573ca12a3cd87ec33
SHA1 4290755b6a49212b2e969200e7a088d1713b84a2
SHA512 e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9
SSDEEP 192:UfHQdurW1hWiSuDz7eCjdks/nGfe4pBjSYp2VZGW5RKTt3E2sVWQ4GWO3uDVqna9:UfVW1hWKDzDm0GftpBjYLm3Sy5lD16hC
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

11:29:f2:b0:ff:a2:cf:91:b1:6c:4e:69:19:d2:b2:7d:bb:36:1d:90:42:5c:d9:2e:5f:9b:17:27:0c:99:8b:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

f9:85:fe:cd:4a:c1:4c:f2:60:3c:23:21:01:f5:0d:02:73:c7:f3:f1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-utility-l1-1-0.pdb

bins/subinacl.exe

IMPHASH 2eaf7681cf60327cff49f2244e0aa8b4
SHA256 371cd9c35282843d572a3186975cc749e425fd4eeae1bb93a9b0cf20c22a9dc8
MD5 7bd591f56af173edc8ca01bd62df6eac
SHA1 43e88cd5cee3b9c66de428c84501d8660ea0586b
SHA512 b88d0c26a6f17d7b2d5483fc9a54002ea9fe26eabf10e5385ce4a13d81db5d7e8421d09bb5eaff453a6f5a210d547cf625fef74d209b2b5f0031621e9796366a
SSDEEP 3072:W856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOi:Z56+Aq4WBTWpSqXhpeEioU2UJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a3:06:29:c2:59:10:a9:3d:2f:3a:60:9f:38:a3:30:d5:8c:9e:a8:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

2

Major OS version

5

Entry point

254419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb

kernel32

WriteConsoleOutputW FormatMessageW CloseHandle GetLastError GetCurrentProcess GetCurrentThread GetConsoleScreenBufferInfo GetStdHandle SetLastError MultiByteToWideChar WriteFile WriteConsoleW SetConsoleTextAttribute GetProcAddress GetModuleHandleW LoadLibraryW GetFileInformationByHandle CreateFileW DeviceIoControl GetCompressedFileSizeW GetFileSizeEx GetComputerNameW WideCharToMultiByte OpenProcess GetFullPathNameW FindClose FindNextFileW FindFirstFileW ExitProcess ExpandEnvironmentStringsW GetCommandLineW SetConsoleCtrlHandler ReadFile GetLargestConsoleWindowSize GetModuleFileNameW FreeLibrary FileTimeToSystemTime FileTimeToLocalFileTime QueryDosDeviceW ReadConsoleW GetSystemTime GetTickCount SetConsoleActiveScreenBuffer LocalFree SystemTimeToFileTime SetConsoleScreenBufferSize CreateConsoleScreenBuffer QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter

mfc42u

ord861 ord800 ord540 ord535 ord3658 ord823 ord538 ord2836 ord825 ord2910 ord858 ord5446 ord6390 ord2099 ord5436 ord6379 ord4199 ord5679 ord4273 ord6279 ord6278 ord5706 ord1863 ord5826 ord3722 ord542 ord802 ord5597 ord6563 ord3898 ord2036 ord5830 ord2440 ord537 ord2756 ord2755 ord2810 ord940 ord925 ord922 ord941 ord942 ord924 ord536 ord4197 ord927 ord4124 ord4272

msvcrt

malloc wprintf _getch wcsstr _wcsicmp wcsncat sprintf wcschr _wtoi __RTDynamicCast iswprint printf _c_exit _exit wcsncmp swscanf wcsrchr towupper _purecall wcsncpy wcscmp fclose _wfopen _setmode fread fwrite fseek swprintf free __CxxFrameHandler _CxxThrowException _XcptFilter _cexit exit __winitenv __wgetmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 ??1type_info@@UAE@XZ ?terminate@@YAXXZ __dllonexit _onexit wcscpy wcslen wcscat _controlfp

msvcirt

??6ostream@@QAEAAV0@PBX@Z ?cout@@3Vostream_withassign@@A

msvcp60

?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z ??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ ?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z ??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ ?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ ??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ ?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ ??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ ??1_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z

advapi32

SetSecurityDescriptorGroup RegGetKeySecurity GetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorSacl SetSecurityDescriptorDacl GetAclInformation GetAce InitializeAcl AddAce RegConnectRegistryW SetNamedSecurityInfoW SetSecurityInfo EnumServicesStatusW OpenServiceW RegSetKeySecurity RegOpenKeyExW RegCreateKeyExW RegCloseKey MakeSelfRelativeSD GetSecurityDescriptorLength SetKernelObjectSecurity QueryUsersOnEncryptedFile QueryRecoveryAgentsOnEncryptedFile FreeEncryptionCertificateHashList ConvertSecurityDescriptorToStringSecurityDescriptorW EqualSid LookupPrivilegeValueW AdjustTokenPrivileges PrivilegeCheck LookupAccountSidW GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority OpenThreadToken OpenProcessToken SetSecurityDescriptorOwner GetSecurityInfo AddAccessAllowedAce InitializeSid GetKernelObjectSecurity GetSecurityDescriptorControl CopySid GetLengthSid GetSecurityDescriptorOwner GetSecurityDescriptorGroup AccessCheck MapGenericMask DeleteAce FreeSid EqualPrefixSid AllocateAndInitializeSid GetSecurityDescriptorSacl GetSecurityDescriptorDacl IsValidSid LookupAccountNameW ConvertSidToStringSidW RegEnumKeyExW RegQueryInfoKeyW OpenSCManagerW LogonUserW ConvertStringSecurityDescriptorToSecurityDescriptorW LsaFreeMemory LsaClose LsaQueryInformationPolicy LsaOpenPolicy

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

netapi32

NetShareSetInfo NetApiBufferFree NetWkstaGetInfo NetGetAnyDCName NetServerGetInfo NetUserModalsGet

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

winspool.drv

ClosePrinter EnumPrintersW GetPrinterW OpenPrinterW SetPrinterW

clusapi

CloseCluster CloseClusterResource ClusterCloseEnum ClusterResourceControl OpenClusterResource ClusterEnum ClusterOpenEnum OpenCluster

ole32

CoInitialize CoCreateInstanceEx

user32

wsprintfW

samlib

SamSetSecurityObject SamLookupNamesInDomain SamOpenUser SamOpenAlias SamOpenGroup SamOpenDomain SamCloseHandle SamEnumerateGroupsInDomain SamEnumerateUsersInDomain SamEnumerateAliasesInDomain SamFreeMemory SamConnect SamQuerySecurityObject

ntdll

RtlInitUnicodeString RtlNtStatusToDosError

shell32

CommandLineToArgvW

cachey-bashi.netcore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9be51e9fbffff4fcc7b6e50d214809f27dde875ad3c3b94961ce46c67cf253f1
MD5 4882fa6dc7bdb4591967d65dd08e0437
SHA1 4c9ea0e2b4c03bfc62d35adc3003d41c5c33839a
SHA512 eddeadd43369d5b03ebd4b6b98063f28e09f0895d4b42d4ab9e81e3adf3f098402449a6b95469bce9ffc228f74216bac066f90805510eb40fca44abdb6c6569a
SSDEEP 384:WshHZppWYoM/aCQFrS9D+gFOIdGqGedGPryhtp/C+XYHGqtsSMJE39PNj2oqIeYW:Ws9ZNoMiC4rQPdG1kkc/C+omqtO7IeYW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

clrcompression.dll

IMPHASH 1dc31de28c38c94cf081a786f0ef0ce1
SHA256 2160fa26c065a8d0eb99623ece1e8195b4f6619d303d0dade90b67253b8124a5
MD5 731a2e11607c5fb53ecfc7f85ccc9450
SHA1 45dc6433da9f944fb1772adb9f6f98fcd89ec59f
SHA512 9b26647460838d4544e9822944cb69aa9f2e431cbabc1a5e2f00e6316b948a898b1723c262a4b7b2437c186164c02db778413a7a868f975dffff1a5c800f6fc9
SSDEEP 12288:nU7xzH286S2bES2e8zIpPK6TMqaxTZHqAHhlyHMD8UXTw05nmZfR7:nUdzH286S2bES2RsK2YThqA0TfAmZfR7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

44:2b:65:17:4b:29:dd:ee:49:a3:6e:7c:eb:af:6e:ea:16:36:85:9c:26:55:6d:61:06:f2:9c:d2:91:05:31:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

248544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\1\s\artifacts\obj\native\netcoreapp-Windows_NT-Release-x86\clrcompression\Release\clrcompression.pdb

clretwrc.dll

SHA256 c518aa4fd6b6bd8b9b67e25d6ed9eb0f5362b6ca7167c68cba03fa29b87f9031
MD5 1484bede7b8f8bf75e36766663948c1b
SHA1 7da631844adce9d68daa03451b70b5071978bb6e
SHA512 df35142828efa0dc0daab2fd2ebc2e13aa17c0be0617114be3673b43e3bc8978917ff26ef3de8f686d3dddb94263b0e824fcc23ad68f1265ddb45d93d46682e9
SSDEEP 1536:9ZspyV7oPFArm7larFdZqRXqFn4Kn3EOF2wyOtfUDdpvpKG:Xsnmrm78dZqRXqGKScfUDZKG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1d:41:17:50:47:d1:43:30:7f:b6:da:4a:cc:b9:b0:a4:bd:41:a4:94:e8:69:c8:d8:68:a3:84:71:2f:f7:99:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\clretwrc\Release\clretwrc.pdb

clrjit.dll

IMPHASH a0aa19c8566cbd21b4879ca7daf0d648
SHA256 189cfe4a35097b406f4b2e58f519a1c177f9171d06e2e4b67f94b0a1ac80b3dd
MD5 db38ca282c085300e4b390e06fdc7d34
SHA1 1c3a3a5a2071748207199eb222f013b26110e448
SHA512 a8a4a9a2e92154c3e75a69377b3f3790cebb328d813d5b2c3f378cde11e6efd5436836044cceb47876f413c36e55ba9a247392c48fd47e300b2ed3a3ad9baf91
SSDEEP 24576:+FywmxpxLypEes7c8cEoxqjLmwAgoJvFLptHwp77svdJWS08MZCf:+FyvzesxcEyqjSVo74vdJCCf
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

79:88:e3:e0:76:6f:a3:07:f4:5f:b3:6e:8f:b3:c1:de:c8:e7:a6:ac:d8:fd:84:1a:f5:e9:52:e6:fc:52:0f:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

683504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\jit\standalone\Release\clrjit.pdb

kernel32

TlsFree TlsSetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW CloseHandle SetEvent ResetEvent WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate GetACP MultiByteToWideChar FormatMessageW LocalFree SetLastError GetCurrentThreadId GetSystemTimeAsFileTime FreeLibrary GetProcAddress GetCurrentProcess TlsGetValue GetFullPathNameW LoadLibraryExW TerminateProcess IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc GetLastError GetCurrentThread QueryThreadCycleTime HeapFree HeapAlloc GetProcessHeap QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte OutputDebugStringA DebugBreak RaiseException DisableThreadLibraryCalls

oleaut32

SetErrorInfo

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise _fdopen _libm_sse2_sin_precise _libm_sse2_sqrt_precise ceil floor _except1 _isnan _CIfmod _finite _copysign

api-ms-win-crt-stdio-l1-1-0

_setmode _fileno _dup __acrt_iob_func setvbuf _wfopen fseek fclose __stdio_common_vsnwprintf_s ftell __stdio_common_vfprintf __stdio_common_vsnprintf_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm _errno _cexit terminate _initterm_e abort _execute_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscpy_s strcpy_s strcat_s strncmp wcsncmp

api-ms-win-crt-heap-l1-1-0

free calloc malloc

coreclr.dll

IMPHASH 05092d9063b6a86fa626d38c09b01a5a
SHA256 7b85273fee5c7789d99013d7f68d463f4316df9f54df3d44240f709c33e444a1
MD5 11500e8a40f627537cacc13320737d3e
SHA1 114a675b03371865e9e2c8cc3697f74bbbf23b9c
SHA512 b0b5a9b85f6873049d8d3e7ea91f3888f858939b5fa6b461533f981e7dbbf9036ead5c6bb1ed4079adea5d9376762b9926e2fe56786dae8cbfea081be85ebf91
SSDEEP 98304:pMBABiVkl6oROHepYlPs+jAvNggEwfgJMBTO:pMBAwVklsepEPswAv2CfvO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ca:96:ac:2b:eb:12:49:85:b2:d6:98:01:e6:17:db:5a:84:f2:c2:4a:10:d9:5e:92:80:64:33:57:46:8f:60:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

1019632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb

kernel32

IsDBCSLeadByte WideCharToMultiByte FormatMessageW LocalFree GetCurrentThreadId GetSystemTimeAsFileTime RaiseException FreeLibrary GetCurrentProcessId OutputDebugStringW IsDebuggerPresent GetProcAddress DebugBreak RaiseFailFastException CloseHandle GetSystemInfo VirtualAllocExNuma GetNumaProcessorNodeEx GetNumaHighestNodeNumber SetThreadGroupAffinity GetSystemTimes GetProcessAffinityMask GetCurrentProcess SwitchToThread FlushInstructionCache GetCurrentThread VerSetConditionMask VerifyVersionInfoW TerminateProcess IsWow64Process GetEnvironmentStringsW FreeEnvironmentStringsW SetErrorMode CreateProcessW GetCPInfo WaitForSingleObject CreateFileMappingW GetFileSize GlobalMemoryStatusEx HeapAlloc GetProcessHeap HeapFree ReleaseMutex SetEvent ReleaseSemaphore WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateSemaphoreExW OpenProcess GetModuleHandleW GetTickCount SetConsoleCtrlHandler CreateThread GetTickCount64 GetLocaleInfoEx GetUserDefaultLocaleName InterlockedPushEntrySList VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate SleepEx GetThreadContext SuspendThread ResumeThread SetThreadContext GetEnabledXStateFeatures InitializeContext SetXStateFeaturesMask Sleep FlushProcessWriteBuffers GetACP QueryPerformanceCounter DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc SignalObjectAndWait SetThreadStackGuarantee ResetEvent CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleExW SetFilePointer ReadFile GetCommandLineW GetProcessTimes WriteFile InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer GetStdHandle GetConsoleOutputCP GetLogicalProcessorInformation MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateMemoryResourceNotification GetActiveProcessorGroupCount GetActiveProcessorCount InitializeSListHead InterlockedFlushSList ExitProcess TlsGetValue RtlUnwind GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcessorNumber ReadProcessMemory OutputDebugStringA SetEnvironmentVariableW GetCurrentProcessorNumberEx SetThreadIdealProcessorEx GetThreadIdealProcessorEx GetLargePageMinimum VirtualUnlock ResetWriteWatch GetWriteWatch SetThreadAffinityMask IsProcessInJob QueryInformationJobObject GetSystemTime MapViewOfFile FlushFileBuffers TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetLocalTime GetTimeFormatW GetDateFormatW IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount EncodePointer TlsFree GetFullPathNameW GetEnvironmentVariableW GetCurrentDirectoryW GetModuleFileNameW CreateDirectoryW GetFileAttributesExW GetFileAttributesW LCMapStringEx LoadLibraryW OpenEventW ExitThread HeapReAlloc CreateNamedPipeA DisconnectNamedPipe ConnectNamedPipe CreateFileW LoadLibraryExW SetLastError LoadLibraryExA MultiByteToWideChar QueryPerformanceFrequency GetLastError

advapi32

SetKernelObjectSecurity AdjustTokenPrivileges LookupPrivilegeValueW EventRegister EventWrite RegEnumValueW DeregisterEventSource ReportEventW RegisterEventSourceW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken SetThreadToken RevertToSelf OpenThreadToken RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoCreateGuid CreateStreamOnHGlobal CoGetClassObject CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoGetContextToken CoGetObjectContext StringFromGUID2 CoReleaseMarshalData CLSIDFromProgID IIDFromString CoTaskMemFree CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoRevokeInitializeSpy

oleaut32

VariantInit SysAllocStringByteLen SysStringByteLen SetErrorInfo LoadRegTypeLi SysAllocString GetErrorInfo SysFreeString SysStringLen SysAllocStringLen QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx SafeArrayDestroy SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound VariantClear CreateErrorInfo VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SafeArrayGetRecordInfo

user32

LoadStringW

shlwapi

PathFindFileNameW

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGetProperty

api-ms-win-crt-string-l1-1-0

strcat_s strcmp strlen strcpy_s strnlen _strnicmp strncpy_s wcsncpy_s _wcsicmp isalpha wcsncmp isdigit strncmp towlower wcscat_s wcsnlen _stricmp iswspace strncat_s wcsncat_s iswascii iswupper wcsncpy wcscpy_s _strdup towupper

api-ms-win-crt-stdio-l1-1-0

_flushall _putws __stdio_common_vswprintf_s __stdio_common_vfwprintf __stdio_common_vswscanf __stdio_common_vsprintf_s _wfopen fputs fclose _wfopen_s fflush __acrt_iob_func __stdio_common_vsnwprintf_s fopen fwrite __stdio_common_vsnprintf_s __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _errno _configure_narrow_argv _initterm_e _initterm _crt_atexit _cexit terminate _invalid_parameter_noinfo abort _controlfp_s _execute_onexit_table _register_onexit_function

api-ms-win-crt-convert-l1-1-0

atoi _wtoi atol strtoul _wcstoui64 wcstoul _ltow_s _itow_s

api-ms-win-crt-utility-l1-1-0

bsearch ldiv qsort

api-ms-win-crt-math-l1-1-0

_libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _CItanh __libm_sse2_acos __libm_sse2_asin _except1 _libm_sse2_tan_precise ceil floor __libm_sse2_atan _libm_sse2_acos_precise __libm_sse2_sin __libm_sse2_pow _CIsinh _CIfmod _CIatan2 _CIcosh _libm_sse2_sqrt_precise asinh __libm_sse2_atan2 cbrt ilogb acosh scalbn fma atanh log2 log2f scalbnf acoshf cbrtf __libm_sse2_cos atanhf modf _copysign ilogbf fmaf asinhf _isnan __libm_sse2_exp __libm_sse2_log __libm_sse2_tan __libm_sse2_log10

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-heap-l1-1-0

calloc free malloc

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

65B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

645KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dbgshim.dll

IMPHASH 00f465c788682fb5c56632d6cd17ef2f
SHA256 3d5d349b38b9484e2b7e716cd524944b4d6dd82b5f308343b2d1797db8d3e01a
MD5 9865f86559d70db3411eac779b656cd6
SHA1 b1a047e85ae65568aa61e6d2bfd534699030c752
SHA512 69ca9531724f70de34ca5332a709f9447364124399e73022486df86ceb0934248f61d7f4014235c6540e380ae517e4d940a61f8b22ebf5f3f9ed9815c7466a56
SSDEEP 3072:SWwU7404m3ZXwMVAL5OMleTsFUdxxSGdu08:Rk0niMVALweU5SiA
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

48:b9:c0:b3:cd:de:05:c6:0f:4d:ab:40:d3:69:be:3c:8e:53:96:8f:97:32:02:b9:5d:af:ff:20:ce:f4:03:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

53776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\dbgshim\Release\dbgshim.pdb

kernel32

HeapAlloc HeapFree RaiseException GetACP LCMapStringEx MultiByteToWideChar IsDBCSLeadByte FormatMessageW LocalFree SetLastError LoadLibraryExW CreateFileW GetEnvironmentVariableW GetFullPathNameW GetSystemTimeAsFileTime TlsGetValue TlsAlloc TlsFree TlsSetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ResetEvent GetProcessHeap CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate GetSystemInfo TerminateProcess IsDebuggerPresent EncodePointer InterlockedFlushSList LoadLibraryW MapViewOfFile CreateFileMappingW K32EnumProcessModules FreeLibrary CreateProcessW GetCurrentProcessId ReadProcessMemory GetFileSize GetProcAddress CreateThread CloseHandle SetEvent GetLastError Sleep ProcessIdToSessionId CreateEventW OpenProcess DuplicateHandle UnmapViewOfFile ResumeThread OpenEventW GetCurrentThreadId WaitForSingleObject K32GetModuleFileNameExW WaitForSingleObjectEx GetCurrentProcess RtlUnwind InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount

user32

LoadStringW

advapi32

CopySid RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorSacl GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid

ole32

CoTaskMemFree

oleaut32

SetErrorInfo

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscat_s strncmp wcsncmp strcpy_s wcsncpy_s wcscpy_s _stricmp

api-ms-win-crt-runtime-l1-1-0

terminate _cexit abort _errno _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free calloc malloc

api-ms-win-crt-convert-l1-1-0

wcstoul

driver/amd64/OemWin2k.inf

SHA256 a6e72b88e42d2b478615c5a16bbedb3fd02b0dd3def3a79840fc6a5df8312707
MD5 b6aada0cbed06889053a05b66f146979
SHA1 823025f02b355b37df7d7657b0f2b4d3584891a5
SHA512 9f8a6b0ad5ae4ea4c14043d663fd5aca2f1884ece0975b13c0533eb93103eb89120c1884121d71c8f9d09f5d210926fdba3b29fc6cf87f601bbc0f359c31d4ad
SSDEEP 192:nr8tW9yCTi394vlQdqKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGZdUWo3DcNSj6jvKFkinuEQTXvzaZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/amd64/devcon.exe

IMPHASH ce4a5cfcfb0452b87e013f07f4d59f9c
SHA256 118e04049f21d272c8005e1e746248a4654b305a41b29e5c735231d2b83bbaa6
MD5 9ab7634bb81f326d489e453c358ae8ea
SHA1 5ea9dfa805f1ae952cb3b66712126ac9c3c985c0
SHA512 c90ab0182709cbf9ea2ba58565fcc6c72b52bc500b5f16a7eba1f107350550725f0ba40bf64102e9e0c8fdc347e0833f67a8bfe4779b3654d0e7d42f7b8bb74d
SSDEEP 1536:EP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WO:EePOYe4bu1epDh8RWO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

3f:4a:34:d7:f1:29:71:aa:cf:ff:c3:17:27:f4:15:7d:33:16:41:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

1

Major OS version

6

Entry point

29456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

devcon.pdb

advapi32

OpenProcessToken RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges InitiateSystemShutdownExW RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW RegDeleteValueW RegSetValueExW

kernel32

GetCurrentProcess FormatMessageW lstrlenW GetLastError CloseHandle LocalFree GetDateFormatW FreeLibrary LoadLibraryW FileTimeToSystemTime GetProcAddress GetFullPathNameW FindFirstFileW GetFileAttributesW FindClose FindNextFileW GetWindowsDirectoryW Sleep TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter

msvcrt

wcschr _wcsicmp towlower _wcsnicmp fputs __iob_func wcsrchr fputws ?terminate@@YAXXZ memset __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm exit _cexit _exit _XcptFilter __C_specific_handler __wgetmainargs wprintf ??2@YAPEAX_K@Z towupper ??3@YAXPEAX@Z iswalpha

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

ole32

CLSIDFromString

setupapi

SetupScanFileQueueW SetupDiGetClassDevsExW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiClassNameFromGuidExW CM_Reenumerate_DevNode_Ex SetupCopyOEMInfW SetupDiSetDeviceRegistryPropertyW SetupDiGetINFClassW CM_Disconnect_Machine SetupDiBuildClassInfoListExW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Get_DevNode_Status_Ex SetupDiBuildDriverInfoList SetupDiGetDeviceInstallParamsW SetupDiOpenDevRegKey SetupDiSetSelectedDriverW SetupGetStringFieldW CM_Get_Res_Des_Data_Size_Ex SetupDiEnumDriverInfoW CM_Free_Log_Conf_Handle CM_Get_Device_ID_ExW CM_Get_Next_Res_Des_Ex SetupCloseFileQueue SetupDiGetDriverInstallParamsW CM_Get_Res_Des_Data_Ex SetupDiOpenClassRegKeyExW SetupCloseInfFile SetupOpenFileQueue SetupDiCallClassInstaller SetupDiDestroyDriverInfoList SetupOpenInfFileW CM_Free_Res_Des_Handle CM_Get_First_Log_Conf_Ex SetupDiSetDeviceInstallParamsW SetupFindFirstLineW SetupDiGetDriverInfoDetailW SetupDiGetClassDescriptionExW SetupDiClassGuidsFromNameExW SetupDiOpenDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiCreateDeviceInfoListExW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

user32

CharNextW CharPrevW LoadStringW

driver/amd64/tap0901.cat

SHA256 b8913d43b03ecf24f466b7bd5046b0c35ec9c43620d10ce3d5dd6538356a85a8
MD5 e0762d9f662614cdc930e211884e9443
SHA1 8016a500b268f2263aa26996f92cad4a9bfe153d
SHA512 618fbf5488f2eeba35b46e4eeabb901b40be20bd9447d49920ad22a9adb23d6dd366556430e24005543bd2ee501848ff7b24bcebf7b15b8ee8543091b73bb449
SSDEEP 192:JLdBt9jnYe+PjP+bkNsG3dZubh9ZZ3xN5BdFJ8y4r:rhjnYPL+StZsZZvjJ8P
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/amd64/tap0901.sys

IMPHASH 741e65dbed0bdb03af558a33e0336da1
SHA256 89cb62e73fbd0500a8b811a632602c504753777313d7e424cca68f1619b55211
MD5 54cb62322b7b1210cb317c4462691b10
SHA1 728cccf1e337641cfe06df85aaa667270c2f540f
SHA512 b9dec2e015659ccd9683ef504f6a912f55e41e87d0d9c698670b1b2db358a1f4997fcc112cf04e850d7b226582a3d234b57ad68b4afd9cff9c9df63b5f2c08fd
SSDEEP 768:JIOPCr6ghD8JTbddDChKSfl4FUFqa0XFC1bRbq0FlCbxG95ux7hqiyc:acCr6gYTb/DoBfi60a0XFC1UP+5ux7jV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

68:e4:62:d0:04:58:56:db:19:4b:bd:8b:f5:13:6c:ca:bf:05:ed:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

1

Major OS version

6

Entry point

41520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samuli\tap-windows-github\src\amd64\tap0901.pdb

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

driver/i386/OemWin2k.inf

SHA256 8892d224ae879cc35ffe216691fc6ba3266d88b6239838f7d38b3a4ff4ad74b6
MD5 35589b966c65a52a1c95791bbcd80543
SHA1 d65994dd38de0e1971f8c99a048c46acc284e8bf
SHA512 ece01e898527ae2ce3039457ea1823bda6351871900c1a7a20057ff3250e33ed8ed216af3318edaa1c3825c17d348dee06078e946d10332e87af8ec45795fd5f
SSDEEP 192:nr8tW9yCTi394vlFKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGcWo3DcNSj6jvKFkinuEQTXvzaZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/i386/devcon.exe

IMPHASH 4a8b1b3af5ed6b972156a2972693a918
SHA256 f228844f92969a6c88ec6b9168815c259881f436f3188f9b038eb0b1dce08bbf
MD5 d0006c3ec1f8b894e41667355b088448
SHA1 8c478cd72bd52bec1283fed9186a9d07a58a084c
SHA512 85424d30cd0607cae58ec1b9053ba6b2f087e148ad6ba029ddcabc4ff33fc97d3a6dddb0f49e5a39cfbe011ae2f9b165ba0490ed9365f081afdf4ab0c15b3c4d
SSDEEP 768:ggEuhGUsQ9Z7lVQpjagwpKsQt2IJU1evxHs4gZWkbqc:t1/9ZisQtBU4xHeWY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4d:32:a9:b6:bc:ff:ee:65:9b:b0:12:c5:5f:79:50:25:94:1b:f0:55

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

2

Major OS version

5

Entry point

21009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress LoadLibraryW GetFileAttributesW GetFullPathNameW TerminateProcess GetModuleHandleA FreeLibrary GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime lstrcpynW FileTimeToSystemTime GetDateFormatW lstrcpyW lstrlenW GetLastError GetCurrentProcess CloseHandle LocalFree FormatMessageW QueryPerformanceCounter

msvcrt

fputws fputs _iob ??3@YAXPAX@Z ??2@YAPAXI@Z wcschr towlower towupper iswalpha _wcsnicmp _wcsicmp _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __wgetmainargs __winitenv exit _cexit _XcptFilter _exit _c_exit wcscmp wprintf wcsrchr

advapi32

OpenProcessToken LookupPrivilegeValueW RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges

setupapi

SetupDiClassGuidsFromNameExW CM_Free_Log_Conf_Handle CM_Get_Next_Res_Des_Ex CM_Free_Res_Des_Handle CM_Get_Res_Des_Data_Size_Ex CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex CM_Disconnect_Machine SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiBuildClassInfoListExW SetupDiClassNameFromGuidExW SetupDiGetClassDescriptionExW SetupDiOpenClassRegKeyExW SetupDiGetDriverInstallParamsW SetupDiSetSelectedDriverW SetupOpenFileQueue SetupDiCallClassInstaller SetupScanFileQueueW SetupCloseFileQueue SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_Device_ID_ExW SetupDiGetDeviceInfoListDetailW SetupDiOpenDeviceInfoW SetupDiGetClassDevsExW SetupDiCreateDeviceInfoListExW CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex CM_Get_First_Log_Conf_Ex

user32

ExitWindowsEx CharNextW LoadStringW CharPrevW

driver/i386/tap0901.cat

SHA256 825cc3efc86cd13fa1bda7d0413d5ca8b208c3a18834ef02637834352ef386fc
MD5 7f49202c5a71e1dd7c85923a5dd45764
SHA1 7e8c115faad3ab2cc53ecfc05cf09e8eabfbffa6
SHA512 62497068c4ed428772ac6236c1383540cf7c48a7ee20b06e0b0e873c51fe69718969ab218f953001403d2e2170e7f29cd84947722e15f55985863a2e79d66d63
SSDEEP 192:XPC9NdKnYe+PjP+bkNsG3dZubh9ZZ3xN5BdFJqTqnG:fgKnYPL+StZsZZvjJMqG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/i386/tap0901.sys

IMPHASH 7bc0e747b3ccfdebdacc897735028b04
SHA256 c43a60e16a011622a963cb93264c7e1365a10fce8c43d5c4fad895880af4dd91
MD5 a23d03a5eb0b221bcd33d98ff30e4dbf
SHA1 9da49918647cf25bcae9538ebf60833d0a3488ea
SHA512 77e9c8e1cd4d7670a9439d006f45ddebb62a33ab4aa7999cf9a0536bd9ae860a0d1a2c7ff50f5e0e50345b7c64619761fa545d10657b6f8fcc31db6d593aea41
SSDEEP 384:lfMsa/mI7L1ypn49O1U1dLn3kDPQXDg8rvfCVUR4KYRGcdq3zhZPvZDsr3549F4o:l09UUPL3sQXDg6iiWA3LZem4L9qDEI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6e:03:12:b3:2a:4f:df:48:c0:cc:8f:e1:86:58:a2:d0:73:7c:c2:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

1

Major OS version

6

Entry point

22495

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Samuli\tap-windows-github\src\i386\tap0901.pdb

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

896B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

994B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e_sqlite3.dll

IMPHASH 3c733b5675643aad72c3f03ebfb1a5b6
SHA256 9877f703ce3fb9669d656d24726159b616b2df25522225bf41bfafe89954c58a
MD5 1aa2fb5e420379a7a50cd650232c6a08
SHA1 e9bb12599f60032a160a00a04203bd73680940cd
SHA512 f908c146cc7299815424debe4d40643864ce442eb30adf148ce05dc2f48e8a9db0697943af55b1c5260f5341ebce57cd804a7b19e71b66510bac085a3f800a59
SSDEEP 24576:FNtiWRtuKKPAq5NY6VxFKolweGUbqf9CTfO3eo2:FNttRtuKQ/V7cejNpo2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

797392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo CloseHandle HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetTimeZoneInformation CompareStringW LCMapStringW DecodePointer FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStdHandle GetFileType GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_pointer sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_create_window_function sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_fts3_may_be_corrupt sqlite3_fts5_may_be_corrupt sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_key sqlite3_key_v2 sqlite3_keyword_check sqlite3_keyword_count sqlite3_keyword_name sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare16_v3 sqlite3_prepare_v2 sqlite3_prepare_v3 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_pointer sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_set_last_insert_rowid sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_isexplain sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_str_append sqlite3_str_appendall sqlite3_str_appendchar sqlite3_str_appendf sqlite3_str_errcode sqlite3_str_finish sqlite3_str_length sqlite3_str_new sqlite3_str_reset sqlite3_str_value sqlite3_str_vappendf sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_frombind sqlite3_value_int sqlite3_value_int64 sqlite3_value_nochange sqlite3_value_numeric_type sqlite3_value_pointer sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_collation sqlite3_vtab_config sqlite3_vtab_nochange sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_set_directory sqlite3_win32_set_directory16 sqlite3_win32_set_directory8 sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug

hostfxr.dll

IMPHASH 585117a8646051ec7b33d62ddd70f8b1
SHA256 e4b827e82536ad3c0b8da06584c54dee8bd0054daf70bec68968573eb0233987
MD5 b47e6482afdceb4d41ebc8d9213efc09
SHA1 11e691ebe4c54961af66f9b8a9925a30799aca54
SHA512 62cedf1697087d1cb7c2a42a270c2c8b642e92ab503302675958af9d078b0e85b2a9286033e83c111d3c5349b2634a9da610a76938b6b33c3cc6f604ae1832c4
SSDEEP 12288:E6rjfxRVTM4u6GKwzw4Uf6mh/EgRqbYSe339v:E6wKd4Uf6Q/rqbYSe9
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4a:c7:df:ab:c8:6a:df:04:cd:85:75:2a:c1:aa:f9:05:05:52:8e:11:8c:23:f0:75:1b:e4:47:bb:54:90:05:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

219312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdb

kernel32

GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CloseHandle GetLastError InitializeCriticalSection GetEnvironmentVariableW LeaveCriticalSection DeleteCriticalSection GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte RtlUnwind OutputDebugStringW FormatMessageW EnterCriticalSection GetModuleHandleA LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetVersionExW FreeLibraryAndExitThread FreeLibrary GetThreadTimes GetCurrentThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait Sleep CreateTimerQueue InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent LCMapStringW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetCurrentThreadId TryEnterCriticalSection RaiseException DecodePointer EncodePointer GetStringTypeW

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_initterm _initialize_onexit_table _initialize_narrow_environment _cexit _configure_narrow_argv _register_onexit_function terminate _execute_onexit_table _initterm_e _errno abort _invalid_parameter_noinfo_noreturn _crt_atexit _seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh malloc

api-ms-win-crt-stdio-l1-1-0

fputc fgetpos fgetc fsetpos fclose _get_stream_buffer_pointers _fseeki64 fwrite __acrt_iob_func fputwc fputws _wfopen setvbuf __stdio_common_vfwprintf __stdio_common_vswprintf ungetc __stdio_common_vswprintf_s _wfsopen fseek fread __stdio_common_vsnprintf_s __stdio_common_vsprintf_s fflush

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_wcsdup strcpy_s islower __strncnt towlower _wcsnicmp wcsncmp isupper _wcsicmp memset strcspn iswspace _isctype_l wcsnlen strnlen

api-ms-win-crt-locale-l1-1-0

_unlock_locales _free_locale _create_locale ___mb_cur_max_func ___lc_locale_name_func __pctype_func ___lc_codepage_func _lock_locales localeconv setlocale

api-ms-win-crt-convert-l1-1-0

_strtod_l _i64tow_s _ui64tow_s _i64toa_s _ui64toa_s wcstoul _wtoi

api-ms-win-crt-math-l1-1-0

_CIexp _CIsqrt _except1 frexp

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64 _time64

hostpolicy.dll

IMPHASH 0b92dc882d8fabe686c0fb2f31d03bba
SHA256 23c20a47a7b220ea5f2b630e03022bf0158c82dbd3ab893b90f62e33b2ab4f54
MD5 0c0213dd626ff7f28851bbbe39539565
SHA1 f78714c73bc90c7af84b5aac5d1b3eeda69b380b
SHA512 b759251f4667c1043e242b48e4da1dd38e02849488934e73d6f2e629924bc95d039ac4ca1d2dbbf9ab5969c9a009140da002808c3f11274e75556b4cb268b53a
SSDEEP 12288:okD2QK9mlJDsC28ejrecQ9OubEXe0cXgv16XzrVwHa:pebQoe0cXA1ArVw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:5c:06:a9:20:1f:a9:a1:ca:b2:32:d4:3f:70:4f:92:a8:5b:e8:0c:a7:4f:94:10:d9:31:0f:41:71:e1:39:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

216480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdb

kernel32

CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CloseHandle GetLastError InitializeCriticalSection GetEnvironmentVariableW LeaveCriticalSection DeleteCriticalSection GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte RtlUnwind OutputDebugStringW FormatMessageW EnterCriticalSection GetModuleHandleA LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW FreeLibraryAndExitThread FreeLibrary GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SetEvent LCMapStringW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError QueryPerformanceCounter RaiseException DecodePointer EncodePointer GetStringTypeW TryEnterCriticalSection GetExitCodeThread GetCurrentThreadId GetCurrentThread SwitchToThread Sleep DuplicateHandle WaitForSingleObjectEx

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _register_onexit_function _seh_filter_dll _execute_onexit_table _initterm_e _errno _cexit _beginthreadex abort _initterm _invalid_parameter_noinfo_noreturn terminate _crt_atexit _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_wcsdup islower __strncnt strcpy_s towlower _wcsnicmp wcsncmp isupper memset _wcsicmp strcspn iswspace _isctype_l wcsnlen strnlen

api-ms-win-crt-heap-l1-1-0

calloc _callnewh free malloc

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fflush fgetc fgetpos fputc fread fsetpos _fseeki64 fwrite setvbuf __stdio_common_vsprintf_s __stdio_common_vsnprintf_s fclose __stdio_common_vswprintf_s __acrt_iob_func fputwc fputws _wfopen _wfsopen fseek __stdio_common_vfwprintf __stdio_common_vswprintf ungetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_free_locale _create_locale setlocale __pctype_func ___lc_locale_name_func ___mb_cur_max_func ___lc_codepage_func _lock_locales _unlock_locales localeconv

api-ms-win-crt-convert-l1-1-0

_strtod_l _i64tow_s _ui64tow_s _i64toa_s _ui64toa_s wcstoul _wtoi

api-ms-win-crt-math-l1-1-0

_CIsqrt _CIexp frexp _except1

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64 _time64

installoptions.jdat

SHA256 dd723d37ef9d85b28d2183484b7fc1acef76e7113719ecb9b74c0791e57de6be
MD5 dd3ae3168a12ad7f0dc03648dc46eb7a
SHA1 86d9b32fbd9b77a7b9c80f9d53be88799aaf0bfc
SHA512 833a10f34cbb5fa2209b4dd55c72fe46c8d82ad6652bfd3574dff4f00ade746f172aaa0ecf8c6e5926785d240c1bd50882521a4e4ea973d50dab6b1a5072840f
MD5 SHA1 SHA512

NSIS installer

installer

lib_SCAPI.dll

IMPHASH 0b4572a3bbd65eee6b558af467fccb3d
SHA256 1f6a67349ac07f331bf42bf755722c7c15ba7c24ba98973a252248e86d1b68b2
MD5 e72e0d7f11cd707ae34de533df5fa6cc
SHA1 c455c9b046cec3c5301f8036e9780dcec42cbeec
SHA512 1dbbfcb491450ef11b21bef25426e864fd28f827a74771e521877c223141ad0d07585bc820b5dd3d80659135ea6e9b9a7c33c3932c7be0d03670bc1587e2eb6a
SSDEEP 1536:sbjbETcL0GzPJfPs01IlUVuzQr7OcAEEsWjcdi+H2VA6PMPwrpMq:sbMIBsElr7cEri+WV/PMoNt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8e:82:67:4c:91:46:88:93:55:9d:78:2a:19:ed:33:e4:ac:ff:b2:0c:67:21:15:e1:9e:fb:fe:c8:38:d4:fd:14

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

12613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\lib_SCAPI.pdb

wintrust

CryptCATAdminAddCatalog CryptCATAdminAcquireContext CryptCATAdminReleaseContext

kernel32

HeapReAlloc HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx RaiseException SetFilePointerEx HeapSize DecodePointer DeleteCriticalSection LoadLibraryW GetProcAddress GetConsoleMode GetConsoleCP CloseHandle SetStdHandle WriteConsoleW GetLastError GetStartupInfoW FlushFileBuffers GetStringTypeW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer GetCommandLineA GetCurrentThreadId IsProcessorFeaturePresent ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetModuleFileNameW SetLastError GetFileType CreateFileW GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind LCMapStringW

advapi32

ChangeServiceConfig2W OpenServiceW OpenSCManagerW CloseServiceHandle

ole32

CoCreateInstance

lib_SCAPISharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8a2de6452ed257d838a8f428bb340d811322dc32456e8f2723dbc8c5ca5601c9
MD5 9a095c3ee1c8210702309e78bbc9e5e3
SHA1 1b0902fa6ba7332da54bf17f83d9b58c97f92616
SHA512 c09ec8aa5031b63cceb39014659d626e1e8d1f7b8e9533228ee9bdfd6e364397ed34355f0bb8ae3a4301810e4602b66ca9399b70f6e4fdc4f20b6cc1a9a703c2
SSDEEP 384:qyDCCC7hKFT1OHizcYdNKs9IzMpHqBQ9EZzHoNZsHLMIhG:qyDuIFJOHizcYHK6ambqVfhG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ec:ae:df:67:25:89:a9:2c:43:d3:7e:8d:7f:68:9f:04:6e:f3:60:d4:95:00:b0:f2:9a:b0:eb:f6:75:42:b5:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

17902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libcrypto-1_1.dll

IMPHASH 840d1b19809c82962b8c90c5984d27e8
SHA256 34f14e8ac45755105a464dc4e93014c1e9778cd88e57463df8cf83f0db820411
MD5 f77ebf3bb87a6b7e6fc52071609cd88e
SHA1 d41ce9a2f1dc351ac0adcb45030a86043dc79128
SHA512 e043669989e28c4b7179e765bd65ae25a16d71bb76467faf812ff7078b228b676e16d64b6dfebb480f78e2a131b6cbbc8715a7cafa2bed5c7863ec5835c9ddf2
SSDEEP 49152:RqLV4BJ3u/v45t9XVM1CPwDv3uFZjkQSHE:sLVwJeo5t9Xa1CPwDv3uFZjk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

1772622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libcrypto-1_1.pdb

ws2_32

getaddrinfo listen sendto recvfrom WSASetLastError send recv shutdown socket setsockopt ntohs connect closesocket bind accept WSAGetLastError WSACleanup WSAStartup gethostbyname getsockopt getsockname ioctlsocket getnameinfo freeaddrinfo

advapi32

CryptCreateHash RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash DeregisterEventSource CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

bcrypt

BCryptGenRandom

kernel32

SetFileAttributesW GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW OutputDebugStringW SetEnvironmentVariableA GetTimeZoneInformation SetEndOfFile GetFullPathNameA GetFileAttributesExW GetCurrentThreadId RtlUnwind HeapSize LoadLibraryExW GetModuleFileNameW GetProcessHeap GetDriveTypeW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber FormatMessageW GetSystemTime SystemTimeToFileTime GetLastError SetLastError GetStdHandle GetEnvironmentVariableW GetFileType WriteFile GetVersion GetModuleHandleW GetProcAddress MultiByteToWideChar CloseHandle FreeLibrary LoadLibraryA LoadLibraryW GetModuleHandleExW FindClose FindFirstFileW FindNextFileW WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedExchangeAdd InterlockedCompareExchange TlsAlloc TlsGetValue TlsSetValue TlsFree GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetCurrentProcess TerminateProcess IsDebuggerPresent IsProcessorFeaturePresent ReadFile InterlockedExchange HeapFree HeapAlloc EncodePointer DecodePointer InterlockedDecrement ExitProcess AreFileApisANSI SetConsoleCtrlHandler HeapReAlloc FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe FileTimeToSystemTime GetCommandLineA GetConsoleCP InterlockedIncrement IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateSemaphoreW FatalAppExitA Sleep SetStdHandle FlushFileBuffers SetFilePointer SetFilePointerEx FindFirstFileExW

ACCESS_DESCRIPTION_free ACCESS_DESCRIPTION_it ACCESS_DESCRIPTION_new ADMISSIONS_free ADMISSIONS_get0_admissionAuthority ADMISSIONS_get0_namingAuthority ADMISSIONS_get0_professionInfos ADMISSIONS_it ADMISSIONS_new ADMISSIONS_set0_admissionAuthority ADMISSIONS_set0_namingAuthority ADMISSIONS_set0_professionInfos ADMISSION_SYNTAX_free ADMISSION_SYNTAX_get0_admissionAuthority ADMISSION_SYNTAX_get0_contentsOfAdmissions ADMISSION_SYNTAX_it ADMISSION_SYNTAX_new ADMISSION_SYNTAX_set0_admissionAuthority ADMISSION_SYNTAX_set0_contentsOfAdmissions AES_bi_ige_encrypt AES_cbc_encrypt AES_cfb128_encrypt AES_cfb1_encrypt AES_cfb8_encrypt AES_decrypt AES_ecb_encrypt AES_encrypt AES_ige_encrypt AES_ofb128_encrypt AES_options AES_set_decrypt_key AES_set_encrypt_key AES_unwrap_key AES_wrap_key ASIdOrRange_free ASIdOrRange_it ASIdOrRange_new ASIdentifierChoice_free ASIdentifierChoice_it ASIdentifierChoice_new ASIdentifiers_free ASIdentifiers_it ASIdentifiers_new ASN1_ANY_it ASN1_BIT_STRING_check ASN1_BIT_STRING_free ASN1_BIT_STRING_get_bit ASN1_BIT_STRING_it ASN1_BIT_STRING_name_print ASN1_BIT_STRING_new ASN1_BIT_STRING_num_asc ASN1_BIT_STRING_set ASN1_BIT_STRING_set_asc ASN1_BIT_STRING_set_bit ASN1_BMPSTRING_free ASN1_BMPSTRING_it ASN1_BMPSTRING_new ASN1_BOOLEAN_it ASN1_ENUMERATED_free ASN1_ENUMERATED_get ASN1_ENUMERATED_get_int64 ASN1_ENUMERATED_it ASN1_ENUMERATED_new ASN1_ENUMERATED_set ASN1_ENUMERATED_set_int64 ASN1_ENUMERATED_to_BN ASN1_FBOOLEAN_it ASN1_GENERALIZEDTIME_adj ASN1_GENERALIZEDTIME_check ASN1_GENERALIZEDTIME_free ASN1_GENERALIZEDTIME_it ASN1_GENERALIZEDTIME_new ASN1_GENERALIZEDTIME_print ASN1_GENERALIZEDTIME_set ASN1_GENERALIZEDTIME_set_string ASN1_GENERALSTRING_free ASN1_GENERALSTRING_it ASN1_GENERALSTRING_new ASN1_IA5STRING_free ASN1_IA5STRING_it ASN1_IA5STRING_new ASN1_INTEGER_cmp ASN1_INTEGER_dup ASN1_INTEGER_free ASN1_INTEGER_get ASN1_INTEGER_get_int64 ASN1_INTEGER_get_uint64 ASN1_INTEGER_it ASN1_INTEGER_new ASN1_INTEGER_set ASN1_INTEGER_set_int64 ASN1_INTEGER_set_uint64 ASN1_INTEGER_to_BN ASN1_ITEM_get ASN1_ITEM_lookup ASN1_NULL_free ASN1_NULL_it ASN1_NULL_new ASN1_OBJECT_create ASN1_OBJECT_free ASN1_OBJECT_it ASN1_OBJECT_new ASN1_OCTET_STRING_NDEF_it ASN1_OCTET_STRING_cmp ASN1_OCTET_STRING_dup ASN1_OCTET_STRING_free ASN1_OCTET_STRING_it ASN1_OCTET_STRING_new ASN1_OCTET_STRING_set ASN1_PCTX_free ASN1_PCTX_get_cert_flags ASN1_PCTX_get_flags ASN1_PCTX_get_nm_flags ASN1_PCTX_get_oid_flags ASN1_PCTX_get_str_flags ASN1_PCTX_new ASN1_PCTX_set_cert_flags ASN1_PCTX_set_flags ASN1_PCTX_set_nm_flags ASN1_PCTX_set_oid_flags ASN1_PCTX_set_str_flags ASN1_PRINTABLESTRING_free ASN1_PRINTABLESTRING_it ASN1_PRINTABLESTRING_new ASN1_PRINTABLE_free ASN1_PRINTABLE_it ASN1_PRINTABLE_new ASN1_PRINTABLE_type ASN1_SCTX_free ASN1_SCTX_get_app_data ASN1_SCTX_get_flags ASN1_SCTX_get_item ASN1_SCTX_get_template ASN1_SCTX_new ASN1_SCTX_set_app_data ASN1_SEQUENCE_ANY_it ASN1_SEQUENCE_it ASN1_SET_ANY_it ASN1_STRING_TABLE_add ASN1_STRING_TABLE_cleanup ASN1_STRING_TABLE_get ASN1_STRING_clear_free ASN1_STRING_cmp ASN1_STRING_copy ASN1_STRING_data ASN1_STRING_dup ASN1_STRING_free ASN1_STRING_get0_data ASN1_STRING_get_default_mask ASN1_STRING_length ASN1_STRING_length_set ASN1_STRING_new ASN1_STRING_print ASN1_STRING_print_ex ASN1_STRING_print_ex_fp ASN1_STRING_set ASN1_STRING_set0 ASN1_STRING_set_by_NID ASN1_STRING_set_default_mask ASN1_STRING_set_default_mask_asc ASN1_STRING_to_UTF8 ASN1_STRING_type ASN1_STRING_type_new ASN1_T61STRING_free ASN1_T61STRING_it ASN1_T61STRING_new ASN1_TBOOLEAN_it ASN1_TIME_adj ASN1_TIME_check ASN1_TIME_cmp_time_t ASN1_TIME_compare ASN1_TIME_diff ASN1_TIME_free ASN1_TIME_it ASN1_TIME_new ASN1_TIME_normalize ASN1_TIME_print ASN1_TIME_set ASN1_TIME_set_string ASN1_TIME_set_string_X509 ASN1_TIME_to_generalizedtime ASN1_TIME_to_tm ASN1_TYPE_cmp ASN1_TYPE_free ASN1_TYPE_get ASN1_TYPE_get_int_octetstring ASN1_TYPE_get_octetstring ASN1_TYPE_new ASN1_TYPE_pack_sequence ASN1_TYPE_set ASN1_TYPE_set1 ASN1_TYPE_set_int_octetstring ASN1_TYPE_set_octetstring ASN1_TYPE_unpack_sequence ASN1_UNIVERSALSTRING_free ASN1_UNIVERSALSTRING_it ASN1_UNIVERSALSTRING_new ASN1_UNIVERSALSTRING_to_string ASN1_UTCTIME_adj ASN1_UTCTIME_check ASN1_UTCTIME_cmp_time_t ASN1_UTCTIME_free ASN1_UTCTIME_it ASN1_UTCTIME_new ASN1_UTCTIME_print ASN1_UTCTIME_set ASN1_UTCTIME_set_string ASN1_UTF8STRING_free ASN1_UTF8STRING_it ASN1_UTF8STRING_new ASN1_VISIBLESTRING_free ASN1_VISIBLESTRING_it ASN1_VISIBLESTRING_new ASN1_add_oid_module ASN1_add_stable_module ASN1_bn_print ASN1_buf_print ASN1_check_infinite_end ASN1_const_check_infinite_end ASN1_d2i_bio ASN1_d2i_fp ASN1_digest ASN1_dup ASN1_generate_nconf ASN1_generate_v3 ASN1_get_object ASN1_i2d_bio ASN1_i2d_fp ASN1_item_d2i ASN1_item_d2i_bio ASN1_item_d2i_fp ASN1_item_digest ASN1_item_dup ASN1_item_ex_d2i ASN1_item_ex_free ASN1_item_ex_i2d ASN1_item_ex_new ASN1_item_free ASN1_item_i2d ASN1_item_i2d_bio ASN1_item_i2d_fp ASN1_item_ndef_i2d ASN1_item_new ASN1_item_pack ASN1_item_print ASN1_item_sign ASN1_item_sign_ctx ASN1_item_unpack ASN1_item_verify ASN1_mbstring_copy ASN1_mbstring_ncopy ASN1_object_size ASN1_parse ASN1_parse_dump ASN1_put_eoc ASN1_put_object ASN1_sign ASN1_str2mask ASN1_tag2bit ASN1_tag2str ASN1_verify ASRange_free ASRange_it ASRange_new ASYNC_WAIT_CTX_clear_fd ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_WAIT_CTX_get_fd ASYNC_WAIT_CTX_new ASYNC_WAIT_CTX_set_wait_fd ASYNC_block_pause ASYNC_cleanup_thread ASYNC_get_current_job ASYNC_get_wait_ctx ASYNC_init_thread ASYNC_is_capable ASYNC_pause_job ASYNC_start_job ASYNC_unblock_pause AUTHORITY_INFO_ACCESS_free AUTHORITY_INFO_ACCESS_it AUTHORITY_INFO_ACCESS_new AUTHORITY_KEYID_free AUTHORITY_KEYID_it AUTHORITY_KEYID_new BASIC_CONSTRAINTS_free BASIC_CONSTRAINTS_it BASIC_CONSTRAINTS_new BF_cbc_encrypt BF_cfb64_encrypt BF_decrypt BF_ecb_encrypt BF_encrypt BF_ofb64_encrypt BF_options BF_set_key BIGNUM_it BIO_ADDRINFO_address BIO_ADDRINFO_family BIO_ADDRINFO_free BIO_ADDRINFO_next BIO_ADDRINFO_protocol BIO_ADDRINFO_socktype BIO_ADDR_clear BIO_ADDR_family BIO_ADDR_free BIO_ADDR_hostname_string BIO_ADDR_new BIO_ADDR_path_string BIO_ADDR_rawaddress BIO_ADDR_rawmake BIO_ADDR_rawport BIO_ADDR_service_string BIO_accept BIO_accept_ex BIO_asn1_get_prefix BIO_asn1_get_suffix BIO_asn1_set_prefix BIO_asn1_set_suffix BIO_bind BIO_callback_ctrl BIO_clear_flags BIO_closesocket BIO_connect BIO_copy_next_retry BIO_ctrl BIO_ctrl_get_read_request BIO_ctrl_get_write_guarantee BIO_ctrl_pending BIO_ctrl_reset_read_request BIO_ctrl_wpending BIO_debug_callback BIO_dgram_non_fatal_error BIO_dump BIO_dump_cb BIO_dump_fp BIO_dump_indent BIO_dump_indent_cb BIO_dump_indent_fp BIO_dup_chain BIO_f_asn1 BIO_f_base64 BIO_f_buffer BIO_f_cipher BIO_f_linebuffer BIO_f_md BIO_f_nbio_test BIO_f_null BIO_f_reliable BIO_fd_non_fatal_error BIO_fd_should_retry BIO_find_type BIO_free BIO_free_all BIO_get_accept_socket BIO_get_callback BIO_get_callback_arg BIO_get_callback_ex BIO_get_data BIO_get_ex_data BIO_get_host_ip BIO_get_init BIO_get_new_index BIO_get_port BIO_get_retry_BIO BIO_get_retry_reason BIO_get_shutdown BIO_gethostbyname BIO_gets BIO_hex_string BIO_indent BIO_int_ctrl BIO_listen BIO_lookup BIO_lookup_ex BIO_meth_free BIO_meth_get_callback_ctrl BIO_meth_get_create BIO_meth_get_ctrl BIO_meth_get_destroy BIO_meth_get_gets BIO_meth_get_puts BIO_meth_get_read BIO_meth_get_read_ex BIO_meth_get_write BIO_meth_get_write_ex BIO_meth_new BIO_meth_set_callback_ctrl BIO_meth_set_create BIO_meth_set_ctrl BIO_meth_set_destroy BIO_meth_set_gets BIO_meth_set_puts BIO_meth_set_read BIO_meth_set_read_ex BIO_meth_set_write BIO_meth_set_write_ex BIO_method_name BIO_method_type BIO_new BIO_new_CMS BIO_new_NDEF BIO_new_PKCS7 BIO_new_accept BIO_new_bio_pair BIO_new_connect BIO_new_dgram BIO_new_fd BIO_new_file BIO_new_fp BIO_new_mem_buf BIO_new_socket BIO_next BIO_nread BIO_nread0 BIO_number_read BIO_number_written BIO_nwrite BIO_nwrite0 BIO_parse_hostserv BIO_pop BIO_printf BIO_ptr_ctrl BIO_push BIO_puts BIO_read BIO_read_ex BIO_s_accept BIO_s_bio BIO_s_connect BIO_s_datagram BIO_s_fd BIO_s_file BIO_s_log BIO_s_mem BIO_s_null BIO_s_secmem BIO_s_socket BIO_set_callback BIO_set_callback_arg BIO_set_callback_ex BIO_set_cipher BIO_set_data BIO_set_ex_data BIO_set_flags BIO_set_init BIO_set_next BIO_set_retry_reason BIO_set_shutdown BIO_set_tcp_ndelay BIO_snprintf BIO_sock_error BIO_sock_info BIO_sock_init BIO_sock_non_fatal_error BIO_sock_should_retry BIO_socket BIO_socket_ioctl BIO_socket_nbio BIO_test_flags BIO_up_ref BIO_vfree BIO_vprintf BIO_vsnprintf BIO_write BIO_write_ex BN_BLINDING_convert BN_BLINDING_convert_ex BN_BLINDING_create_param BN_BLINDING_free BN_BLINDING_get_flags BN_BLINDING_invert BN_BLINDING_invert_ex BN_BLINDING_is_current_thread BN_BLINDING_lock BN_BLINDING_new BN_BLINDING_set_current_thread BN_BLINDING_set_flags BN_BLINDING_unlock BN_BLINDING_update BN_CTX_end BN_CTX_free BN_CTX_get BN_CTX_new BN_CTX_secure_new BN_CTX_start BN_GENCB_call BN_GENCB_free BN_GENCB_get_arg BN_GENCB_new BN_GENCB_set BN_GENCB_set_old BN_GF2m_add BN_GF2m_arr2poly BN_GF2m_mod BN_GF2m_mod_arr BN_GF2m_mod_div BN_GF2m_mod_div_arr BN_GF2m_mod_exp BN_GF2m_mod_exp_arr BN_GF2m_mod_inv BN_GF2m_mod_inv_arr BN_GF2m_mod_mul BN_GF2m_mod_mul_arr BN_GF2m_mod_solve_quad BN_GF2m_mod_solve_quad_arr BN_GF2m_mod_sqr BN_GF2m_mod_sqr_arr BN_GF2m_mod_sqrt BN_GF2m_mod_sqrt_arr BN_GF2m_poly2arr BN_MONT_CTX_copy BN_MONT_CTX_free BN_MONT_CTX_new BN_MONT_CTX_set BN_MONT_CTX_set_locked BN_RECP_CTX_free BN_RECP_CTX_new BN_RECP_CTX_set BN_X931_derive_prime_ex BN_X931_generate_Xpq BN_X931_generate_prime_ex BN_abs_is_word BN_add BN_add_word BN_asc2bn BN_bin2bn BN_bn2bin BN_bn2binpad BN_bn2dec BN_bn2hex BN_bn2lebinpad BN_bn2mpi BN_bntest_rand BN_clear BN_clear_bit BN_clear_free BN_cmp BN_consttime_swap BN_copy BN_dec2bn BN_div BN_div_recp BN_div_word BN_dup BN_exp BN_free BN_from_montgomery BN_gcd BN_generate_dsa_nonce BN_generate_prime BN_generate_prime_ex BN_get0_nist_prime_192 BN_get0_nist_prime_224 BN_get0_nist_prime_256 BN_get0_nist_prime_384 BN_get0_nist_prime_521 BN_get_flags BN_get_params BN_get_rfc2409_prime_1024 BN_get_rfc2409_prime_768 BN_get_rfc3526_prime_1536 BN_get_rfc3526_prime_2048 BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_4096 BN_get_rfc3526_prime_6144 BN_get_rfc3526_prime_8192 BN_get_word BN_hex2bn BN_is_bit_set BN_is_negative BN_is_odd BN_is_one BN_is_prime BN_is_prime_ex BN_is_prime_fasttest BN_is_prime_fasttest_ex BN_is_word BN_is_zero BN_kronecker BN_lebin2bn BN_lshift BN_lshift1 BN_mask_bits BN_mod_add BN_mod_add_quick BN_mod_exp BN_mod_exp2_mont BN_mod_exp_mont BN_mod_exp_mont_consttime BN_mod_exp_mont_word BN_mod_exp_recp BN_mod_exp_simple BN_mod_inverse BN_mod_lshift BN_mod_lshift1 BN_mod_lshift1_quick BN_mod_lshift_quick BN_mod_mul BN_mod_mul_montgomery BN_mod_mul_reciprocal BN_mod_sqr BN_mod_sqrt BN_mod_sub BN_mod_sub_quick BN_mod_word BN_mpi2bn BN_mul BN_mul_word BN_new BN_nist_mod_192 BN_nist_mod_224 BN_nist_mod_256 BN_nist_mod_384 BN_nist_mod_521 BN_nist_mod_func BN_nnmod BN_num_bits BN_num_bits_word BN_options BN_print BN_print_fp BN_priv_rand BN_priv_rand_range BN_pseudo_rand BN_pseudo_rand_range BN_rand BN_rand_range BN_reciprocal BN_rshift BN_rshift1 BN_secure_new BN_security_bits BN_set_bit BN_set_flags BN_set_negative BN_set_params BN_set_word BN_sqr BN_sub BN_sub_word BN_swap BN_to_ASN1_ENUMERATED BN_to_ASN1_INTEGER BN_to_montgomery BN_uadd BN_ucmp BN_usub BN_value_one BN_with_flags BN_zero_ex BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_MEM_new_ex BUF_reverse CAST_cbc_encrypt CAST_cfb64_encrypt CAST_decrypt CAST_ecb_encrypt CAST_encrypt CAST_ofb64_encrypt CAST_set_key CBIGNUM_it CERTIFICATEPOLICIES_free CERTIFICATEPOLICIES_it CERTIFICATEPOLICIES_new CMAC_CTX_cleanup CMAC_CTX_copy CMAC_CTX_free CMAC_CTX_get0_cipher_ctx CMAC_CTX_new CMAC_Final CMAC_Init CMAC_Update CMAC_resume CMS_ContentInfo_free CMS_ContentInfo_it CMS_ContentInfo_new CMS_ContentInfo_print_ctx CMS_EncryptedData_decrypt CMS_EncryptedData_encrypt CMS_EncryptedData_set1_key CMS_EnvelopedData_create CMS_ReceiptRequest_create0 CMS_ReceiptRequest_free CMS_ReceiptRequest_get0_values CMS_ReceiptRequest_it CMS_ReceiptRequest_new CMS_RecipientEncryptedKey_cert_cmp CMS_RecipientEncryptedKey_get0_id CMS_RecipientInfo_decrypt CMS_RecipientInfo_encrypt CMS_RecipientInfo_get0_pkey_ctx CMS_RecipientInfo_kari_decrypt CMS_RecipientInfo_kari_get0_alg CMS_RecipientInfo_kari_get0_ctx CMS_RecipientInfo_kari_get0_orig_id CMS_RecipientInfo_kari_get0_reks CMS_RecipientInfo_kari_orig_id_cmp CMS_RecipientInfo_kari_set0_pkey CMS_RecipientInfo_kekri_get0_id CMS_RecipientInfo_kekri_id_cmp CMS_RecipientInfo_ktri_cert_cmp CMS_RecipientInfo_ktri_get0_algs CMS_RecipientInfo_ktri_get0_signer_id CMS_RecipientInfo_set0_key CMS_RecipientInfo_set0_password CMS_RecipientInfo_set0_pkey CMS_RecipientInfo_type CMS_SharedInfo_encode CMS_SignedData_init CMS_SignerInfo_cert_cmp CMS_SignerInfo_get0_algs CMS_SignerInfo_get0_md_ctx CMS_SignerInfo_get0_pkey_ctx CMS_SignerInfo_get0_signature CMS_SignerInfo_get0_signer_id CMS_SignerInfo_set1_signer_cert CMS_SignerInfo_sign CMS_SignerInfo_verify CMS_SignerInfo_verify_content CMS_add0_CertificateChoices CMS_add0_RevocationInfoChoice CMS_add0_cert CMS_add0_crl CMS_add0_recipient_key CMS_add0_recipient_password CMS_add1_ReceiptRequest CMS_add1_cert CMS_add1_crl CMS_add1_recipient_cert CMS_add1_signer CMS_add_simple_smimecap CMS_add_smimecap CMS_add_standard_smimecap CMS_compress CMS_data CMS_dataFinal CMS_dataInit CMS_data_create CMS_decrypt CMS_decrypt_set1_key CMS_decrypt_set1_password CMS_decrypt_set1_pkey CMS_digest_create CMS_digest_verify CMS_encrypt CMS_final CMS_get0_RecipientInfos CMS_get0_SignerInfos CMS_get0_content CMS_get0_eContentType CMS_get0_signers CMS_get0_type CMS_get1_ReceiptRequest CMS_get1_certs CMS_get1_crls CMS_is_detached CMS_set1_eContentType CMS_set1_signers_certs CMS_set_detached CMS_sign CMS_sign_receipt CMS_signed_add1_attr CMS_signed_add1_attr_by_NID CMS_signed_add1_attr_by_OBJ CMS_signed_add1_attr_by_txt CMS_signed_delete_attr CMS_signed_get0_data_by_OBJ CMS_signed_get_attr CMS_signed_get_attr_by_NID CMS_signed_get_attr_by_OBJ CMS_signed_get_attr_count CMS_stream CMS_uncompress CMS_unsigned_add1_attr CMS_unsigned_add1_attr_by_NID CMS_unsigned_add1_attr_by_OBJ CMS_unsigned_add1_attr_by_txt CMS_unsigned_delete_attr CMS_unsigned_get0_data_by_OBJ CMS_unsigned_get_attr CMS_unsigned_get_attr_by_NID CMS_unsigned_get_attr_by_OBJ CMS_unsigned_get_attr_count CMS_verify CMS_verify_receipt COMP_CTX_free COMP_CTX_get_method COMP_CTX_get_type COMP_CTX_new COMP_compress_block COMP_expand_block COMP_get_name COMP_get_type COMP_zlib CONF_dump_bio CONF_dump_fp CONF_free CONF_get1_default_config_file CONF_get_number CONF_get_section CONF_get_string CONF_imodule_get_flags CONF_imodule_get_module CONF_imodule_get_name CONF_imodule_get_usr_data CONF_imodule_get_value CONF_imodule_set_flags CONF_imodule_set_usr_data CONF_load CONF_load_bio CONF_load_fp CONF_module_add CONF_module_get_usr_data CONF_module_set_usr_data CONF_modules_finish CONF_modules_load CONF_modules_load_file CONF_modules_unload CONF_parse_list CONF_set_default_method CONF_set_nconf CRL_DIST_POINTS_free CRL_DIST_POINTS_it CRL_DIST_POINTS_new CRYPTO_128_unwrap CRYPTO_128_unwrap_pad CRYPTO_128_wrap CRYPTO_128_wrap_pad CRYPTO_THREAD_cleanup_local CRYPTO_THREAD_compare_id CRYPTO_THREAD_get_current_id CRYPTO_THREAD_get_local CRYPTO_THREAD_init_local CRYPTO_THREAD_lock_free CRYPTO_THREAD_lock_new CRYPTO_THREAD_read_lock CRYPTO_THREAD_run_once CRYPTO_THREAD_set_local CRYPTO_THREAD_unlock CRYPTO_THREAD_write_lock CRYPTO_atomic_add CRYPTO_cbc128_decrypt CRYPTO_cbc128_encrypt CRYPTO_ccm128_aad CRYPTO_ccm128_decrypt CRYPTO_ccm128_decrypt_ccm64 CRYPTO_ccm128_encrypt CRYPTO_ccm128_encrypt_ccm64 CRYPTO_ccm128_init CRYPTO_ccm128_setiv CRYPTO_ccm128_tag CRYPTO_cfb128_1_encrypt CRYPTO_cfb128_8_encrypt CRYPTO_cfb128_encrypt CRYPTO_clear_free CRYPTO_clear_realloc CRYPTO_ctr128_encrypt CRYPTO_ctr128_encrypt_ctr32 CRYPTO_cts128_decrypt CRYPTO_cts128_decrypt_block CRYPTO_cts128_encrypt CRYPTO_cts128_encrypt_block CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_free_ex_index CRYPTO_gcm128_aad CRYPTO_gcm128_decrypt CRYPTO_gcm128_decrypt_ctr32 CRYPTO_gcm128_encrypt CRYPTO_gcm128_encrypt_ctr32 CRYPTO_gcm128_finish CRYPTO_gcm128_init CRYPTO_gcm128_new CRYPTO_gcm128_release CRYPTO_gcm128_setiv CRYPTO_gcm128_tag CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_get_mem_functions CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_memdup CRYPTO_new_ex_data CRYPTO_nistcts128_decrypt CRYPTO_nistcts128_decrypt_block CRYPTO_nistcts128_encrypt CRYPTO_nistcts128_encrypt_block CRYPTO_ocb128_aad CRYPTO_ocb128_cleanup CRYPTO_ocb128_copy_ctx CRYPTO_ocb128_decrypt CRYPTO_ocb128_encrypt CRYPTO_ocb128_finish CRYPTO_ocb128_init CRYPTO_ocb128_new CRYPTO_ocb128_setiv CRYPTO_ocb128_tag CRYPTO_ofb128_encrypt CRYPTO_realloc CRYPTO_secure_actual_size CRYPTO_secure_allocated CRYPTO_secure_clear_free CRYPTO_secure_free CRYPTO_secure_malloc CRYPTO_secure_malloc_done CRYPTO_secure_malloc_init CRYPTO_secure_malloc_initialized CRYPTO_secure_used CRYPTO_secure_zalloc CRYPTO_set_ex_data CRYPTO_set_mem_debug CRYPTO_set_mem_functions CRYPTO_strdup CRYPTO_strndup CRYPTO_xts128_encrypt CRYPTO_zalloc CTLOG_STORE_free CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file CTLOG_STORE_load_file CTLOG_STORE_new CTLOG_free CTLOG_get0_log_id CTLOG_get0_name CTLOG_get0_public_key CTLOG_new CTLOG_new_from_base64 CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_get0_cert CT_POLICY_EVAL_CTX_get0_issuer CT_POLICY_EVAL_CTX_get0_log_store CT_POLICY_EVAL_CTX_get_time CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time Camellia_cbc_encrypt Camellia_cfb128_encrypt Camellia_cfb1_encrypt Camellia_cfb8_encrypt Camellia_ctr128_encrypt Camellia_decrypt Camellia_ecb_encrypt Camellia_encrypt Camellia_ofb128_encrypt Camellia_set_key DES_cbc_cksum DES_cbc_encrypt DES_cfb64_encrypt DES_cfb_encrypt DES_check_key_parity DES_crypt DES_decrypt3 DES_ecb3_encrypt DES_ecb_encrypt DES_ede3_cbc_encrypt DES_ede3_cfb64_encrypt DES_ede3_cfb_encrypt DES_ede3_ofb64_encrypt DES_encrypt1 DES_encrypt2 DES_encrypt3 DES_fcrypt DES_is_weak_key DES_key_sched DES_ncbc_encrypt DES_ofb64_encrypt DES_ofb_encrypt DES_options DES_pcbc_encrypt DES_quad_cksum DES_random_key DES_set_key DES_set_key_checked DES_set_key_unchecked DES_set_odd_parity DES_string_to_2keys DES_string_to_key DES_xcbc_encrypt DH_KDF_X9_42 DH_OpenSSL DH_bits DH_check DH_check_ex DH_check_params DH_check_params_ex DH_check_pub_key DH_check_pub_key_ex DH_clear_flags DH_compute_key DH_compute_key_padded DH_free DH_generate_key DH_generate_parameters DH_generate_parameters_ex DH_get0_engine DH_get0_g DH_get0_key DH_get0_p DH_get0_pqg DH_get0_priv_key DH_get0_pub_key DH_get0_q DH_get_1024_160 DH_get_2048_224 DH_get_2048_256 DH_get_default_method DH_get_ex_data DH_get_length DH_get_nid DH_meth_dup DH_meth_free DH_meth_get0_app_data DH_meth_get0_name DH_meth_get_bn_mod_exp DH_meth_get_compute_key DH_meth_get_finish DH_meth_get_flags DH_meth_get_generate_key DH_meth_get_generate_params DH_meth_get_init DH_meth_new DH_meth_set0_app_data DH_meth_set1_name DH_meth_set_bn_mod_exp DH_meth_set_compute_key DH_meth_set_finish DH_meth_set_flags DH_meth_set_generate_key DH_meth_set_generate_params DH_meth_set_init DH_new DH_new_by_nid DH_new_method DH_security_bits DH_set0_key DH_set0_pqg DH_set_default_method DH_set_ex_data DH_set_flags DH_set_length DH_set_method DH_size DH_test_flags DH_up_ref DHparams_dup DHparams_it DHparams_print DHparams_print_fp DIRECTORYSTRING_free DIRECTORYSTRING_it DIRECTORYSTRING_new DISPLAYTEXT_free DISPLAYTEXT_it DISPLAYTEXT_new DIST_POINT_NAME_free DIST_POINT_NAME_it DIST_POINT_NAME_new DIST_POINT_free DIST_POINT_it DIST_POINT_new DIST_POINT_set_dpname DSA_OpenSSL DSA_SIG_free DSA_SIG_get0 DSA_SIG_new DSA_SIG_set0 DSA_bits DSA_clear_flags DSA_do_sign DSA_do_verify DSA_dup_DH DSA_free DSA_generate_key DSA_generate_parameters DSA_generate_parameters_ex DSA_get0_engine DSA_get0_g DSA_get0_key DSA_get0_p DSA_get0_pqg DSA_get0_priv_key DSA_get0_pub_key DSA_get0_q DSA_get_default_method DSA_get_ex_data DSA_get_method DSA_meth_dup DSA_meth_free DSA_meth_get0_app_data DSA_meth_get0_name DSA_meth_get_bn_mod_exp DSA_meth_get_finish DSA_meth_get_flags DSA_meth_get_init DSA_meth_get_keygen DSA_meth_get_mod_exp DSA_meth_get_paramgen DSA_meth_get_sign DSA_meth_get_sign_setup DSA_meth_get_verify DSA_meth_new DSA_meth_set0_app_data DSA_meth_set1_name DSA_meth_set_bn_mod_exp DSA_meth_set_finish DSA_meth_set_flags DSA_meth_set_init DSA_meth_set_keygen DSA_meth_set_mod_exp DSA_meth_set_paramgen DSA_meth_set_sign DSA_meth_set_sign_setup DSA_meth_set_verify DSA_new DSA_new_method DSA_print DSA_print_fp DSA_security_bits DSA_set0_key DSA_set0_pqg DSA_set_default_method DSA_set_ex_data DSA_set_flags DSA_set_method DSA_sign DSA_sign_setup DSA_size DSA_test_flags DSA_up_ref DSA_verify DSAparams_dup DSAparams_print DSAparams_print_fp DSO_METHOD_openssl DSO_bind_func DSO_convert_filename DSO_ctrl DSO_dsobyaddr DSO_flags DSO_free DSO_get_filename DSO_global_lookup DSO_load DSO_merge DSO_new DSO_pathbyaddr DSO_set_filename DSO_up_ref ECDH_KDF_X9_62 ECDH_compute_key ECDSA_SIG_free ECDSA_SIG_get0 ECDSA_SIG_get0_r ECDSA_SIG_get0_s ECDSA_SIG_new ECDSA_SIG_set0 ECDSA_do_sign ECDSA_do_sign_ex ECDSA_do_verify ECDSA_sign ECDSA_sign_ex ECDSA_sign_setup ECDSA_size ECDSA_verify ECPARAMETERS_free ECPARAMETERS_it ECPARAMETERS_new ECPKPARAMETERS_free ECPKPARAMETERS_it ECPKPARAMETERS_new ECPKParameters_print ECPKParameters_print_fp ECParameters_print ECParameters_print_fp EC_GF2m_simple_method EC_GFp_mont_method EC_GFp_nist_method EC_GFp_simple_method EC_GROUP_check EC_GROUP_check_discriminant EC_GROUP_clear_free EC_GROUP_cmp EC_GROUP_copy EC_GROUP_dup EC_GROUP_free EC_GROUP_get0_cofactor EC_GROUP_get0_generator EC_GROUP_get0_order EC_GROUP_get0_seed EC_GROUP_get_asn1_flag EC_GROUP_get_basis_type EC_GROUP_get_cofactor EC_GROUP_get_curve EC_GROUP_get_curve_GF2m EC_GROUP_get_curve_GFp EC_GROUP_get_curve_name EC_GROUP_get_degree EC_GROUP_get_ecparameters EC_GROUP_get_ecpkparameters EC_GROUP_get_mont_data EC_GROUP_get_order EC_GROUP_get_pentanomial_basis EC_GROUP_get_point_conversion_form EC_GROUP_get_seed_len EC_GROUP_get_trinomial_basis EC_GROUP_have_precompute_mult EC_GROUP_method_of EC_GROUP_new EC_GROUP_new_by_curve_name EC_GROUP_new_curve_GF2m EC_GROUP_new_curve_GFp EC_GROUP_new_from_ecparameters EC_GROUP_new_from_ecpkparameters EC_GROUP_order_bits EC_GROUP_precompute_mult EC_GROUP_set_asn1_flag EC_GROUP_set_curve EC_GROUP_set_curve_GF2m EC_GROUP_set_curve_GFp EC_GROUP_set_curve_name EC_GROUP_set_generator EC_GROUP_set_point_conversion_form EC_GROUP_set_seed EC_KEY_METHOD_free EC_KEY_METHOD_get_compute_key EC_KEY_METHOD_get_init EC_KEY_METHOD_get_keygen EC_KEY_METHOD_get_sign EC_KEY_METHOD_get_verify EC_KEY_METHOD_new EC_KEY_METHOD_set_compute_key EC_KEY_METHOD_set_init EC_KEY_METHOD_set_keygen EC_KEY_METHOD_set_sign EC_KEY_METHOD_set_verify EC_KEY_OpenSSL EC_KEY_can_sign EC_KEY_check_key EC_KEY_clear_flags EC_KEY_copy EC_KEY_dup EC_KEY_free EC_KEY_generate_key EC_KEY_get0_engine EC_KEY_get0_group EC_KEY_get0_private_key EC_KEY_get0_public_key EC_KEY_get_conv_form EC_KEY_get_default_method EC_KEY_get_enc_flags EC_KEY_get_ex_data EC_KEY_get_flags EC_KEY_get_method EC_KEY_key2buf EC_KEY_new EC_KEY_new_by_curve_name EC_KEY_new_method EC_KEY_oct2key EC_KEY_oct2priv EC_KEY_precompute_mult EC_KEY_print EC_KEY_print_fp EC_KEY_priv2buf EC_KEY_priv2oct EC_KEY_set_asn1_flag EC_KEY_set_conv_form EC_KEY_set_default_method EC_KEY_set_enc_flags EC_KEY_set_ex_data EC_KEY_set_flags EC_KEY_set_group EC_KEY_set_method EC_KEY_set_private_key EC_KEY_set_public_key EC_KEY_set_public_key_affine_coordinates EC_KEY_up_ref EC_METHOD_get_field_type EC_POINT_add EC_POINT_bn2point EC_POINT_clear_free EC_POINT_cmp EC_POINT_copy EC_POINT_dbl EC_POINT_dup EC_POINT_free EC_POINT_get_Jprojective_coordinates_GFp EC_POINT_get_affine_coordinates EC_POINT_get_affine_coordinates_GF2m EC_POINT_get_affine_coordinates_GFp EC_POINT_hex2point EC_POINT_invert EC_POINT_is_at_infinity EC_POINT_is_on_curve EC_POINT_make_affine EC_POINT_method_of EC_POINT_mul EC_POINT_new EC_POINT_oct2point EC_POINT_point2bn EC_POINT_point2buf EC_POINT_point2hex EC_POINT_point2oct EC_POINT_set_Jprojective_coordinates_GFp EC_POINT_set_affine_coordinates EC_POINT_set_affine_coordinates_GF2m EC_POINT_set_affine_coordinates_GFp EC_POINT_set_compressed_coordinates EC_POINT_set_compressed_coordinates_GF2m EC_POINT_set_compressed_coordinates_GFp EC_POINT_set_to_infinity EC_POINTs_make_affine EC_POINTs_mul EC_curve_nid2nist EC_curve_nist2nid EC_get_builtin_curves EDIPARTYNAME_free EDIPARTYNAME_it EDIPARTYNAME_new ENGINE_add ENGINE_add_conf_module ENGINE_by_id ENGINE_cmd_is_executable ENGINE_ctrl ENGINE_ctrl_cmd ENGINE_ctrl_cmd_string ENGINE_finish ENGINE_free ENGINE_get_DH ENGINE_get_DSA ENGINE_get_EC ENGINE_get_RAND ENGINE_get_RSA ENGINE_get_cipher ENGINE_get_cipher_engine ENGINE_get_ciphers ENGINE_get_cmd_defns ENGINE_get_ctrl_function ENGINE_get_default_DH ENGINE_get_default_DSA ENGINE_get_default_EC ENGINE_get_default_RAND ENGINE_get_default_RSA ENGINE_get_destroy_function ENGINE_get_digest ENGINE_get_digest_engine ENGINE_get_digests ENGINE_get_ex_data ENGINE_get_finish_function ENGINE_get_first ENGINE_get_flags ENGINE_get_id ENGINE_get_init_function ENGINE_get_last ENGINE_get_load_privkey_function ENGINE_get_load_pubkey_function ENGINE_get_name ENGINE_get_next ENGINE_get_pkey_asn1_meth ENGINE_get_pkey_asn1_meth_engine ENGINE_get_pkey_asn1_meth_str ENGINE_get_pkey_asn1_meths ENGINE_get_pkey_meth ENGINE_get_pkey_meth_engine ENGINE_get_pkey_meths ENGINE_get_prev ENGINE_get_ssl_client_cert_function ENGINE_get_static_state ENGINE_get_table_flags ENGINE_init ENGINE_load_builtin_engines ENGINE_load_private_key ENGINE_load_public_key ENGINE_load_ssl_client_cert ENGINE_new ENGINE_pkey_asn1_find_str ENGINE_register_DH ENGINE_register_DSA ENGINE_register_EC ENGINE_register_RAND ENGINE_register_RSA ENGINE_register_all_DH ENGINE_register_all_DSA ENGINE_register_all_EC ENGINE_register_all_RAND ENGINE_register_all_RSA ENGINE_register_all_ciphers ENGINE_register_all_complete ENGINE_register_all_digests ENGINE_register_all_pkey_asn1_meths ENGINE_register_all_pkey_meths ENGINE_register_ciphers ENGINE_register_complete ENGINE_register_digests ENGINE_register_pkey_asn1_meths ENGINE_register_pkey_meths ENGINE_remove ENGINE_set_DH ENGINE_set_DSA ENGINE_set_EC ENGINE_set_RAND ENGINE_set_RSA ENGINE_set_ciphers ENGINE_set_cmd_defns ENGINE_set_ctrl_function ENGINE_set_default ENGINE_set_default_DH ENGINE_set_default_DSA ENGINE_set_default_EC ENGINE_set_default_RAND ENGINE_set_default_RSA ENGINE_set_default_ciphers ENGINE_set_default_digests ENGINE_set_default_pkey_asn1_meths ENGINE_set_default_pkey_meths ENGINE_set_default_string ENGINE_set_destroy_function ENGINE_set_digests ENGINE_set_ex_data ENGINE_set_finish_function ENGINE_set_flags ENGINE_set_id ENGINE_set_init_function ENGINE_set_load_privkey_function ENGINE_set_load_pubkey_function ENGINE_set_load_ssl_client_cert_function ENGINE_set_name ENGINE_set_pkey_asn1_meths ENGINE_set_pkey_meths ENGINE_set_table_flags ENGINE_unregister_DH ENGINE_unregister_DSA ENGINE_unregister_EC ENGINE_unregister_RAND ENGINE_unregister_RSA ENGINE_unregister_ciphers ENGINE_unregister_digests ENGINE_unregister_pkey_asn1_meths ENGINE_unregister_pkey_meths ENGINE_up_ref ERR_add_error_data ERR_add_error_vdata ERR_clear_error ERR_clear_last_mark ERR_error_string ERR_error_string_n ERR_func_error_string ERR_get_error ERR_get_error_line ERR_get_error_line_data ERR_get_next_error_library ERR_get_state ERR_lib_error_string ERR_load_ASN1_strings ERR_load_ASYNC_strings ERR_load_BIO_strings ERR_load_BN_strings ERR_load_BUF_strings ERR_load_CMS_strings ERR_load_COMP_strings ERR_load_CONF_strings ERR_load_CRYPTO_strings ERR_load_CT_strings ERR_load_DH_strings ERR_load_DSA_strings ERR_load_DSO_strings ERR_load_EC_strings ERR_load_ENGINE_strings ERR_load_ERR_strings ERR_load_EVP_strings ERR_load_KDF_strings ERR_load_OBJ_strings ERR_load_OCSP_strings ERR_load_OSSL_STORE_strings ERR_load_PEM_strings ERR_load_PKCS12_strings ERR_load_PKCS7_strings ERR_load_RAND_strings ERR_load_RSA_strings ERR_load_TS_strings ERR_load_UI_strings ERR_load_X509V3_strings ERR_load_X509_strings ERR_load_strings ERR_load_strings_const ERR_peek_error ERR_peek_error_line ERR_peek_error_line_data ERR_peek_last_error ERR_peek_last_error_line ERR_peek_last_error_line_data ERR_pop_to_mark ERR_print_errors ERR_print_errors_cb ERR_print_errors_fp ERR_put_error ERR_reason_error_string ERR_remove_state ERR_remove_thread_state ERR_set_error_data ERR_set_mark ERR_unload_strings ESS_CERT_ID_V2_dup ESS_CERT_ID_V2_free ESS_CERT_ID_V2_new ESS_CERT_ID_dup ESS_CERT_ID_free ESS_CERT_ID_new ESS_ISSUER_SERIAL_dup ESS_ISSUER_SERIAL_free ESS_ISSUER_SERIAL_new ESS_SIGNING_CERT_V2_dup ESS_SIGNING_CERT_V2_free ESS_SIGNING_CERT_V2_new ESS_SIGNING_CERT_dup ESS_SIGNING_CERT_free ESS_SIGNING_CERT_new EVP_BytesToKey EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_buf_noconst EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_clear_flags EVP_CIPHER_CTX_copy EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_encrypting EVP_CIPHER_CTX_free EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_iv EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_iv_noconst EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_nid EVP_CIPHER_CTX_num EVP_CIPHER_CTX_original_iv EVP_CIPHER_CTX_rand_key EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_set_cipher_data EVP_CIPHER_CTX_set_flags EVP_CIPHER_CTX_set_key_length EVP_CIPHER_CTX_set_num EVP_CIPHER_CTX_set_padding EVP_CIPHER_CTX_test_flags EVP_CIPHER_asn1_to_param EVP_CIPHER_block_size EVP_CIPHER_do_all EVP_CIPHER_do_all_sorted EVP_CIPHER_flags EVP_CIPHER_get_asn1_iv EVP_CIPHER_impl_ctx_size EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_meth_dup EVP_CIPHER_meth_free EVP_CIPHER_meth_get_cleanup EVP_CIPHER_meth_get_ctrl EVP_CIPHER_meth_get_do_cipher EVP_CIPHER_meth_get_get_asn1_params EVP_CIPHER_meth_get_init EVP_CIPHER_meth_get_set_asn1_params EVP_CIPHER_meth_new EVP_CIPHER_meth_set_cleanup EVP_CIPHER_meth_set_ctrl EVP_CIPHER_meth_set_do_cipher EVP_CIPHER_meth_set_flags EVP_CIPHER_meth_set_get_asn1_params EVP_CIPHER_meth_set_impl_ctx_size EVP_CIPHER_meth_set_init EVP_CIPHER_meth_set_iv_length EVP_CIPHER_meth_set_set_asn1_params EVP_CIPHER_nid EVP_CIPHER_param_to_asn1 EVP_CIPHER_set_asn1_iv EVP_CIPHER_type EVP_Cipher EVP_CipherFinal EVP_CipherFinal_ex EVP_CipherInit EVP_CipherInit_ex EVP_CipherUpdate EVP_DecodeBlock EVP_DecodeFinal EVP_DecodeInit EVP_DecodeUpdate EVP_DecryptFinal EVP_DecryptFinal_ex EVP_DecryptInit EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinalXOF EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSign EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerify EVP_DigestVerifyFinal EVP_DigestVerifyInit EVP_ENCODE_CTX_copy EVP_ENCODE_CTX_free EVP_ENCODE_CTX_new EVP_ENCODE_CTX_num EVP_EncodeBlock EVP_EncodeFinal EVP_EncodeInit EVP_EncodeUpdate EVP_EncryptFinal EVP_EncryptFinal_ex EVP_EncryptInit EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_clear_flags EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_ctrl EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_md_data EVP_MD_CTX_new EVP_MD_CTX_pkey_ctx EVP_MD_CTX_reset EVP_MD_CTX_set_flags EVP_MD_CTX_set_pkey_ctx EVP_MD_CTX_set_update_fn EVP_MD_CTX_test_flags EVP_MD_CTX_update_fn EVP_MD_block_size EVP_MD_do_all EVP_MD_do_all_sorted EVP_MD_flags EVP_MD_meth_dup EVP_MD_meth_free EVP_MD_meth_get_app_datasize EVP_MD_meth_get_cleanup EVP_MD_meth_get_copy EVP_MD_meth_get_ctrl EVP_MD_meth_get_final EVP_MD_meth_get_flags EVP_MD_meth_get_init EVP_MD_meth_get_input_blocksize EVP_MD_meth_get_result_size EVP_MD_meth_get_update EVP_MD_meth_new EVP_MD_meth_set_app_datasize EVP_MD_meth_set_cleanup EVP_MD_meth_set_copy EVP_MD_meth_set_ctrl EVP_MD_meth_set_final EVP_MD_meth_set_flags EVP_MD_meth_set_init EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size EVP_MD_meth_set_update EVP_MD_pkey_type EVP_MD_size EVP_MD_type EVP_OpenFinal EVP_OpenInit EVP_PBE_CipherInit EVP_PBE_alg_add EVP_PBE_alg_add_type EVP_PBE_cleanup EVP_PBE_find EVP_PBE_get EVP_PBE_scrypt EVP_PKCS82PKEY EVP_PKEY2PKCS8 EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_ctrl_uint64 EVP_PKEY_CTX_dup EVP_PKEY_CTX_free EVP_PKEY_CTX_get0_peerkey EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get_app_data EVP_PKEY_CTX_get_cb EVP_PKEY_CTX_get_data EVP_PKEY_CTX_get_keygen_info EVP_PKEY_CTX_get_operation EVP_PKEY_CTX_hex2ctrl EVP_PKEY_CTX_md EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_set0_keygen_info EVP_PKEY_CTX_set_app_data EVP_PKEY_CTX_set_cb EVP_PKEY_CTX_set_data EVP_PKEY_CTX_str2ctrl EVP_PKEY_add1_attr EVP_PKEY_add1_attr_by_NID EVP_PKEY_add1_attr_by_OBJ EVP_PKEY_add1_attr_by_txt EVP_PKEY_asn1_add0 EVP_PKEY_asn1_add_alias EVP_PKEY_asn1_copy EVP_PKEY_asn1_find EVP_PKEY_asn1_find_str EVP_PKEY_asn1_free EVP_PKEY_asn1_get0 EVP_PKEY_asn1_get0_info EVP_PKEY_asn1_get_count EVP_PKEY_asn1_new EVP_PKEY_asn1_set_check EVP_PKEY_asn1_set_ctrl EVP_PKEY_asn1_set_free EVP_PKEY_asn1_set_get_priv_key EVP_PKEY_asn1_set_get_pub_key EVP_PKEY_asn1_set_item EVP_PKEY_asn1_set_param EVP_PKEY_asn1_set_param_check EVP_PKEY_asn1_set_private EVP_PKEY_asn1_set_public EVP_PKEY_asn1_set_public_check EVP_PKEY_asn1_set_security_bits EVP_PKEY_asn1_set_set_priv_key EVP_PKEY_asn1_set_set_pub_key EVP_PKEY_asn1_set_siginf EVP_PKEY_assign EVP_PKEY_base_id EVP_PKEY_bits EVP_PKEY_check EVP_PKEY_cmp EVP_PKEY_cmp_parameters EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_decrypt_old EVP_PKEY_delete_attr EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_encrypt_old EVP_PKEY_free EVP_PKEY_get0 EVP_PKEY_get0_DH EVP_PKEY_get0_DSA EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get0_asn1 EVP_PKEY_get0_engine EVP_PKEY_get0_hmac EVP_PKEY_get0_poly1305 EVP_PKEY_get0_siphash EVP_PKEY_get1_DH EVP_PKEY_get1_DSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_get1_tls_encodedpoint EVP_PKEY_get_attr EVP_PKEY_get_attr_by_NID EVP_PKEY_get_attr_by_OBJ EVP_PKEY_get_attr_count EVP_PKEY_get_default_digest_nid EVP_PKEY_get_raw_private_key EVP_PKEY_get_raw_public_key EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_meth_add0 EVP_PKEY_meth_copy EVP_PKEY_meth_find EVP_PKEY_meth_free EVP_PKEY_meth_get0 EVP_PKEY_meth_get0_info EVP_PKEY_meth_get_check EVP_PKEY_meth_get_cleanup EVP_PKEY_meth_get_copy EVP_PKEY_meth_get_count EVP_PKEY_meth_get_ctrl EVP_PKEY_meth_get_decrypt EVP_PKEY_meth_get_derive EVP_PKEY_meth_get_digest_custom EVP_PKEY_meth_get_encrypt EVP_PKEY_meth_get_init EVP_PKEY_meth_get_keygen EVP_PKEY_meth_get_param_check EVP_PKEY_meth_get_paramgen EVP_PKEY_meth_get_public_check EVP_PKEY_meth_get_sign EVP_PKEY_meth_get_signctx EVP_PKEY_meth_get_verify EVP_PKEY_meth_get_verify_recover EVP_PKEY_meth_get_verifyctx EVP_PKEY_meth_new EVP_PKEY_meth_remove EVP_PKEY_meth_set_check EVP_PKEY_meth_set_cleanup EVP_PKEY_meth_set_copy EVP_PKEY_meth_set_ctrl EVP_PKEY_meth_set_decrypt EVP_PKEY_meth_set_derive EVP_PKEY_meth_set_digest_custom EVP_PKEY_meth_set_encrypt EVP_PKEY_meth_set_init EVP_PKEY_meth_set_keygen EVP_PKEY_meth_set_param_check EVP_PKEY_meth_set_paramgen EVP_PKEY_meth_set_public_check EVP_PKEY_meth_set_sign EVP_PKEY_meth_set_signctx EVP_PKEY_meth_set_verify EVP_PKEY_meth_set_verify_recover EVP_PKEY_meth_set_verifyctx EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_CMAC_key EVP_PKEY_new_mac_key EVP_PKEY_new_raw_private_key EVP_PKEY_new_raw_public_key EVP_PKEY_param_check EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_print_params EVP_PKEY_print_private EVP_PKEY_print_public EVP_PKEY_public_check EVP_PKEY_save_parameters EVP_PKEY_security_bits EVP_PKEY_set1_DH EVP_PKEY_set1_DSA EVP_PKEY_set1_EC_KEY EVP_PKEY_set1_RSA EVP_PKEY_set1_engine EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_set_alias_type EVP_PKEY_set_type EVP_PKEY_set_type_str EVP_PKEY_sign EVP_PKEY_sign_init EVP_PKEY_size EVP_PKEY_type EVP_PKEY_up_ref EVP_PKEY_verify EVP_PKEY_verify_init EVP_PKEY_verify_recover EVP_PKEY_verify_recover_init EVP_SealFinal EVP_SealInit EVP_SignFinal EVP_VerifyFinal EVP_add_alg_module EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_128_ccm EVP_aes_128_cfb1 EVP_aes_128_cfb128 EVP_aes_128_cfb8 EVP_aes_128_ctr EVP_aes_128_ecb EVP_aes_128_gcm EVP_aes_128_ocb EVP_aes_128_ofb EVP_aes_128_wrap EVP_aes_128_wrap_pad EVP_aes_128_xts EVP_aes_192_cbc EVP_aes_192_ccm EVP_aes_192_cfb1 EVP_aes_192_cfb128 EVP_aes_192_cfb8 EVP_aes_192_ctr EVP_aes_192_ecb EVP_aes_192_gcm EVP_aes_192_ocb EVP_aes_192_ofb EVP_aes_192_wrap EVP_aes_192_wrap_pad EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha256 EVP_aes_256_ccm EVP_aes_256_cfb1 EVP_aes_256_cfb128 EVP_aes_256_cfb8 EVP_aes_256_ctr EVP_aes_256_ecb EVP_aes_256_gcm EVP_aes_256_ocb EVP_aes_256_ofb EVP_aes_256_wrap EVP_aes_256_wrap_pad EVP_aes_256_xts EVP_aria_128_cbc EVP_aria_128_ccm EVP_aria_128_cfb1 EVP_aria_128_cfb128 EVP_aria_128_cfb8 EVP_aria_128_ctr EVP_aria_128_ecb EVP_aria_128_gcm EVP_aria_128_ofb EVP_aria_192_cbc EVP_aria_192_ccm EVP_aria_192_cfb1 EVP_aria_192_cfb128 EVP_aria_192_cfb8 EVP_aria_192_ctr EVP_aria_192_ecb EVP_aria_192_gcm EVP_aria_192_ofb EVP_aria_256_cbc EVP_aria_256_ccm EVP_aria_256_cfb1 EVP_aria_256_cfb128 EVP_aria_256_cfb8 EVP_aria_256_ctr EVP_aria_256_ecb EVP_aria_256_gcm EVP_aria_256_ofb EVP_bf_cbc EVP_bf_cfb64 EVP_bf_ecb EVP_bf_ofb EVP_blake2b512 EVP_blake2s256 EVP_camellia_128_cbc EVP_camellia_128_cfb1 EVP_camellia_128_cfb128 EVP_camellia_128_cfb8 EVP_camellia_128_ctr EVP_camellia_128_ecb EVP_camellia_128_ofb EVP_camellia_192_cbc EVP_camellia_192_cfb1 EVP_camellia_192_cfb128 EVP_camellia_192_cfb8 EVP_camellia_192_ctr EVP_camellia_192_ecb EVP_camellia_192_ofb EVP_camellia_256_cbc EVP_camellia_256_cfb1 EVP_camellia_256_cfb128 EVP_camellia_256_cfb8 EVP_camellia_256_ctr EVP_camellia_256_ecb EVP_camellia_256_ofb EVP_cast5_cbc EVP_cast5_cfb64 EVP_cast5_ecb EVP_cast5_ofb EVP_chacha20 EVP_chacha20_poly1305 EVP_des_cbc EVP_des_cfb1 EVP_des_cfb64 EVP_des_cfb8 EVP_des_ecb EVP_des_ede EVP_des_ede3 EVP_des_ede3_cbc EVP_des_ede3_cfb1 EVP_des_ede3_cfb64 EVP_des_ede3_cfb8 EVP_des_ede3_ecb EVP_des_ede3_ofb EVP_des_ede3_wrap EVP_des_ede_cbc EVP_des_ede_cfb64 EVP_des_ede_ecb EVP_des_ede_ofb EVP_des_ofb EVP_desx_cbc EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_get_pw_prompt EVP_idea_cbc EVP_idea_cfb64 EVP_idea_ecb EVP_idea_ofb EVP_md4 EVP_md5 EVP_md5_sha1 EVP_md_null EVP_mdc2 EVP_rc2_40_cbc EVP_rc2_64_cbc EVP_rc2_cbc EVP_rc2_cfb64 EVP_rc2_ecb EVP_rc2_ofb EVP_rc4 EVP_rc4_40 EVP_rc4_hmac_md5 EVP_read_pw_string EVP_read_pw_string_min EVP_ripemd160 EVP_seed_cbc EVP_seed_cfb128 EVP_seed_ecb EVP_seed_ofb EVP_set_pw_prompt EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha3_224 EVP_sha3_256 EVP_sha3_384 EVP_sha3_512 EVP_sha512 EVP_sha512_224 EVP_sha512_256 EVP_shake128 EVP_shake256 EVP_sm3 EVP_sm4_cbc EVP_sm4_cfb128 EVP_sm4_ctr EVP_sm4_ecb EVP_sm4_ofb EVP_whirlpool EXTENDED_KEY_USAGE_free EXTENDED_KEY_USAGE_it EXTENDED_KEY_USAGE_new FIPS_mode FIPS_mode_set GENERAL_NAMES_free GENERAL_NAMES_it GENERAL_NAMES_new GENERAL_NAME_cmp GENERAL_NAME_dup GENERAL_NAME_free GENERAL_NAME_get0_otherName GENERAL_NAME_get0_value GENERAL_NAME_it GENERAL_NAME_new GENERAL_NAME_print GENERAL_NAME_set0_othername GENERAL_NAME_set0_value GENERAL_SUBTREE_free GENERAL_SUBTREE_it GENERAL_SUBTREE_new HMAC HMAC_CTX_copy HMAC_CTX_free HMAC_CTX_get_md HMAC_CTX_new HMAC_CTX_reset HMAC_CTX_set_flags HMAC_Final HMAC_Init HMAC_Init_ex HMAC_Update HMAC_size IDEA_cbc_encrypt IDEA_cfb64_encrypt IDEA_ecb_encrypt IDEA_encrypt IDEA_ofb64_encrypt IDEA_options IDEA_set_decrypt_key IDEA_set_encrypt_key INT32_it INT64_it IPAddressChoice_free IPAddressChoice_it IPAddressChoice_new IPAddressFamily_free IPAddressFamily_it IPAddressFamily_new IPAddressOrRange_free IPAddressOrRange_it IPAddressOrRange_new IPAddressRange_free IPAddressRange_it IPAddressRange_new ISSUING_DIST_POINT_free ISSUING_DIST_POINT_it ISSUING_DIST_POINT_new LONG_it MD4 MD4_Final MD4_Init MD4_Transform MD4_Update MD5 MD5_Final MD5_Init MD5_Transform MD5_Update MDC2 MDC2_Final MDC2_Init MDC2_Update NAME_CONSTRAINTS_check NAME_CONSTRAINTS_check_CN NAME_CONSTRAINTS_free NAME_CONSTRAINTS_it NAME_CONSTRAINTS_new NAMING_AUTHORITY_free NAMING_AUTHORITY_get0_authorityId NAMING_AUTHORITY_get0_authorityText NAMING_AUTHORITY_get0_authorityURL NAMING_AUTHORITY_it NAMING_AUTHORITY_new NAMING_AUTHORITY_set0_authorityId NAMING_AUTHORITY_set0_authorityText NAMING_AUTHORITY_set0_authorityURL NCONF_WIN32 NCONF_default NCONF_dump_bio NCONF_dump_fp NCONF_free NCONF_free_data NCONF_get_number_e NCONF_get_section NCONF_get_string NCONF_load NCONF_load_bio NCONF_load_fp NCONF_new NETSCAPE_CERT_SEQUENCE_free NETSCAPE_CERT_SEQUENCE_it NETSCAPE_CERT_SEQUENCE_new NETSCAPE_SPKAC_free NETSCAPE_SPKAC_it NETSCAPE_SPKAC_new NETSCAPE_SPKI_b64_decode NETSCAPE_SPKI_b64_encode NETSCAPE_SPKI_free NETSCAPE_SPKI_get_pubkey NETSCAPE_SPKI_it NETSCAPE_SPKI_new NETSCAPE_SPKI_print NETSCAPE_SPKI_set_pubkey NETSCAPE_SPKI_sign NETSCAPE_SPKI_verify NOTICEREF_free NOTICEREF_it NOTICEREF_new OBJ_NAME_add OBJ_NAME_cleanup OBJ_NAME_do_all OBJ_NAME_do_all_sorted OBJ_NAME_get OBJ_NAME_init OBJ_NAME_new_index OBJ_NAME_remove OBJ_add_object OBJ_add_sigid OBJ_bsearch_ OBJ_bsearch_ex_ OBJ_cmp OBJ_create OBJ_create_objects OBJ_dup OBJ_find_sigid_algs OBJ_find_sigid_by_algs OBJ_get0_data OBJ_length OBJ_ln2nid OBJ_new_nid OBJ_nid2ln OBJ_nid2obj OBJ_nid2sn OBJ_obj2nid OBJ_obj2txt OBJ_sigid_free OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OCSP_BASICRESP_add1_ext_i2d OCSP_BASICRESP_add_ext OCSP_BASICRESP_delete_ext OCSP_BASICRESP_free OCSP_BASICRESP_get1_ext_d2i OCSP_BASICRESP_get_ext OCSP_BASICRESP_get_ext_by_NID OCSP_BASICRESP_get_ext_by_OBJ OCSP_BASICRESP_get_ext_by_critical OCSP_BASICRESP_get_ext_count OCSP_BASICRESP_it OCSP_BASICRESP_new OCSP_CERTID_dup OCSP_CERTID_free OCSP_CERTID_it OCSP_CERTID_new OCSP_CERTSTATUS_free OCSP_CERTSTATUS_it OCSP_CERTSTATUS_new OCSP_CRLID_free OCSP_CRLID_it OCSP_CRLID_new OCSP_ONEREQ_add1_ext_i2d OCSP_ONEREQ_add_ext OCSP_ONEREQ_delete_ext OCSP_ONEREQ_free OCSP_ONEREQ_get1_ext_d2i OCSP_ONEREQ_get_ext OCSP_ONEREQ_get_ext_by_NID OCSP_ONEREQ_get_ext_by_OBJ OCSP_ONEREQ_get_ext_by_critical OCSP_ONEREQ_get_ext_count OCSP_ONEREQ_it OCSP_ONEREQ_new OCSP_REQINFO_free OCSP_REQINFO_it OCSP_REQINFO_new OCSP_REQUEST_add1_ext_i2d OCSP_REQUEST_add_ext OCSP_REQUEST_delete_ext OCSP_REQUEST_free OCSP_REQUEST_get1_ext_d2i OCSP_REQUEST_get_ext OCSP_REQUEST_get_ext_by_NID OCSP_REQUEST_get_ext_by_OBJ OCSP_REQUEST_get_ext_by_critical OCSP_REQUEST_get_ext_count OCSP_REQUEST_it OCSP_REQUEST_new OCSP_REQUEST_print OCSP_REQ_CTX_add1_header OCSP_REQ_CTX_free OCSP_REQ_CTX_get0_mem_bio OCSP_REQ_CTX_http OCSP_REQ_CTX_i2d OCSP_REQ_CTX_nbio OCSP_REQ_CTX_nbio_d2i OCSP_REQ_CTX_new OCSP_REQ_CTX_set1_req OCSP_RESPBYTES_free OCSP_RESPBYTES_it OCSP_RESPBYTES_new OCSP_RESPDATA_free OCSP_RESPDATA_it OCSP_RESPDATA_new OCSP_RESPID_free OCSP_RESPID_it OCSP_RESPID_match OCSP_RESPID_new OCSP_RESPID_set_by_key OCSP_RESPID_set_by_name OCSP_RESPONSE_free OCSP_RESPONSE_it OCSP_RESPONSE_new OCSP_RESPONSE_print OCSP_REVOKEDINFO_free OCSP_REVOKEDINFO_it OCSP_REVOKEDINFO_new OCSP_SERVICELOC_free OCSP_SERVICELOC_it OCSP_SERVICELOC_new OCSP_SIGNATURE_free OCSP_SIGNATURE_it OCSP_SIGNATURE_new OCSP_SINGLERESP_add1_ext_i2d OCSP_SINGLERESP_add_ext OCSP_SINGLERESP_delete_ext OCSP_SINGLERESP_free OCSP_SINGLERESP_get0_id OCSP_SINGLERESP_get1_ext_d2i OCSP_SINGLERESP_get_ext OCSP_SINGLERESP_get_ext_by_NID OCSP_SINGLERESP_get_ext_by_OBJ OCSP_SINGLERESP_get_ext_by_critical OCSP_SINGLERESP_get_ext_count OCSP_SINGLERESP_it OCSP_SINGLERESP_new OCSP_accept_responses_new OCSP_archive_cutoff_new OCSP_basic_add1_cert OCSP_basic_add1_nonce OCSP_basic_add1_status OCSP_basic_sign OCSP_basic_sign_ctx OCSP_basic_verify OCSP_cert_id_new OCSP_cert_status_str OCSP_cert_to_id OCSP_check_nonce OCSP_check_validity OCSP_copy_nonce OCSP_crlID_new OCSP_crl_reason_str OCSP_id_cmp OCSP_id_get0_info OCSP_id_issuer_cmp OCSP_onereq_get0_id OCSP_parse_url OCSP_request_add0_id OCSP_request_add1_cert OCSP_request_add1_nonce OCSP_request_is_signed OCSP_request_onereq_count OCSP_request_onereq_get0 OCSP_request_set1_name OCSP_request_sign OCSP_request_verify OCSP_resp_count OCSP_resp_find OCSP_resp_find_status OCSP_resp_get0 OCSP_resp_get0_certs OCSP_resp_get0_id OCSP_resp_get0_produced_at OCSP_resp_get0_respdata OCSP_resp_get0_signature OCSP_resp_get0_signer OCSP_resp_get0_tbs_sigalg OCSP_resp_get1_id OCSP_response_create OCSP_response_get1_basic OCSP_response_status OCSP_response_status_str OCSP_sendreq_bio OCSP_sendreq_nbio OCSP_sendreq_new OCSP_set_max_response_length OCSP_single_get0_status OCSP_url_svcloc_new OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_INIT_free OPENSSL_INIT_new OPENSSL_INIT_set_config_appname OPENSSL_INIT_set_config_file_flags OPENSSL_INIT_set_config_filename OPENSSL_LH_delete OPENSSL_LH_doall OPENSSL_LH_doall_arg OPENSSL_LH_error OPENSSL_LH_free OPENSSL_LH_get_down_load OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_node_stats OPENSSL_LH_node_stats_bio OPENSSL_LH_node_usage_stats OPENSSL_LH_node_usage_stats_bio OPENSSL_LH_num_items OPENSSL_LH_retrieve OPENSSL_LH_set_down_load OPENSSL_LH_stats OPENSSL_LH_stats_bio OPENSSL_LH_strhash OPENSSL_asc2uni OPENSSL_atexit OPENSSL_buf2hexstr OPENSSL_cleanse OPENSSL_cleanup OPENSSL_config OPENSSL_die OPENSSL_gmtime OPENSSL_gmtime_adj OPENSSL_gmtime_diff OPENSSL_hexchar2int OPENSSL_hexstr2buf OPENSSL_init OPENSSL_init_crypto OPENSSL_isservice OPENSSL_issetugid OPENSSL_load_builtin_modules OPENSSL_memcmp OPENSSL_sk_deep_copy OPENSSL_sk_delete OPENSSL_sk_delete_ptr OPENSSL_sk_dup OPENSSL_sk_find OPENSSL_sk_find_ex OPENSSL_sk_free OPENSSL_sk_insert OPENSSL_sk_is_sorted OPENSSL_sk_new OPENSSL_sk_new_null OPENSSL_sk_new_reserve OPENSSL_sk_num OPENSSL_sk_pop OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_reserve OPENSSL_sk_set OPENSSL_sk_set_cmp_func OPENSSL_sk_shift OPENSSL_sk_sort OPENSSL_sk_unshift OPENSSL_sk_value OPENSSL_sk_zero OPENSSL_strlcat OPENSSL_strlcpy OPENSSL_strnlen OPENSSL_thread_stop OPENSSL_uni2asc OPENSSL_uni2utf8 OPENSSL_utf82uni OSSL_STORE_INFO_free OSSL_STORE_INFO_get0_CERT OSSL_STORE_INFO_get0_CRL OSSL_STORE_INFO_get0_NAME OSSL_STORE_INFO_get0_NAME_description OSSL_STORE_INFO_get0_PARAMS OSSL_STORE_INFO_get0_PKEY OSSL_STORE_INFO_get1_CERT OSSL_STORE_INFO_get1_CRL OSSL_STORE_INFO_get1_NAME OSSL_STORE_INFO_get1_NAME_description OSSL_STORE_INFO_get1_PARAMS OSSL_STORE_INFO_get1_PKEY OSSL_STORE_INFO_get_type OSSL_STORE_INFO_new_CERT OSSL_STORE_INFO_new_CRL OSSL_STORE_INFO_new_NAME OSSL_STORE_INFO_new_PARAMS OSSL_STORE_INFO_new_PKEY OSSL_STORE_INFO_set0_NAME_description OSSL_STORE_INFO_type_string OSSL_STORE_LOADER_free OSSL_STORE_LOADER_get0_engine OSSL_STORE_LOADER_get0_scheme OSSL_STORE_LOADER_new OSSL_STORE_LOADER_set_close OSSL_STORE_LOADER_set_ctrl OSSL_STORE_LOADER_set_eof OSSL_STORE_LOADER_set_error OSSL_STORE_LOADER_set_expect OSSL_STORE_LOADER_set_find OSSL_STORE_LOADER_set_load OSSL_STORE_LOADER_set_open OSSL_STORE_SEARCH_by_alias OSSL_STORE_SEARCH_by_issuer_serial OSSL_STORE_SEARCH_by_key_fingerprint OSSL_STORE_SEARCH_by_name OSSL_STORE_SEARCH_free OSSL_STORE_SEARCH_get0_bytes OSSL_STORE_SEARCH_get0_digest OSSL_STORE_SEARCH_get0_name OSSL_STORE_SEARCH_get0_serial OSSL_STORE_SEARCH_get0_string OSSL_STORE_SEARCH_get_type OSSL_STORE_close OSSL_STORE_ctrl OSSL_STORE_do_all_loaders OSSL_STORE_eof OSSL_STORE_error OSSL_STORE_expect OSSL_STORE_find OSSL_STORE_load OSSL_STORE_open OSSL_STORE_register_loader OSSL_STORE_supports_search OSSL_STORE_unregister_loader OSSL_STORE_vctrl OTHERNAME_cmp OTHERNAME_free OTHERNAME_it OTHERNAME_new OpenSSL_version OpenSSL_version_num PBE2PARAM_free PBE2PARAM_it PBE2PARAM_new PBEPARAM_free PBEPARAM_it PBEPARAM_new PBKDF2PARAM_free PBKDF2PARAM_it PBKDF2PARAM_new PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_SignFinal PEM_SignInit PEM_SignUpdate PEM_X509_INFO_read PEM_X509_INFO_read_bio PEM_X509_INFO_write_bio PEM_bytes_read_bio PEM_bytes_read_bio_secmem PEM_def_callback PEM_dek_info PEM_do_header PEM_get_EVP_CIPHER_INFO PEM_proc_type PEM_read PEM_read_CMS PEM_read_DHparams PEM_read_DSAPrivateKey PEM_read_DSA_PUBKEY PEM_read_DSAparams PEM_read_ECPKParameters PEM_read_ECPrivateKey PEM_read_EC_PUBKEY PEM_read_NETSCAPE_CERT_SEQUENCE PEM_read_PKCS7 PEM_read_PKCS8 PEM_read_PKCS8_PRIV_KEY_INFO PEM_read_PUBKEY PEM_read_PrivateKey PEM_read_RSAPrivateKey PEM_read_RSAPublicKey PEM_read_RSA_PUBKEY PEM_read_X509 PEM_read_X509_AUX PEM_read_X509_CRL PEM_read_X509_REQ PEM_read_bio PEM_read_bio_CMS PEM_read_bio_DHparams PEM_read_bio_DSAPrivateKey PEM_read_bio_DSA_PUBKEY PEM_read_bio_DSAparams PEM_read_bio_ECPKParameters PEM_read_bio_ECPrivateKey PEM_read_bio_EC_PUBKEY PEM_read_bio_NETSCAPE_CERT_SEQUENCE PEM_read_bio_PKCS7 PEM_read_bio_PKCS8 PEM_read_bio_PKCS8_PRIV_KEY_INFO PEM_read_bio_PUBKEY PEM_read_bio_Parameters PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_RSAPublicKey PEM_read_bio_RSA_PUBKEY PEM_read_bio_X509 PEM_read_bio_X509_AUX PEM_read_bio_X509_CRL PEM_read_bio_X509_REQ PEM_read_bio_ex PEM_write PEM_write_CMS PEM_write_DHparams PEM_write_DHxparams PEM_write_DSAPrivateKey PEM_write_DSA_PUBKEY PEM_write_DSAparams PEM_write_ECPKParameters PEM_write_ECPrivateKey PEM_write_EC_PUBKEY PEM_write_NETSCAPE_CERT_SEQUENCE PEM_write_PKCS7 PEM_write_PKCS8 PEM_write_PKCS8PrivateKey PEM_write_PKCS8PrivateKey_nid PEM_write_PKCS8_PRIV_KEY_INFO PEM_write_PUBKEY PEM_write_PrivateKey PEM_write_RSAPrivateKey PEM_write_RSAPublicKey PEM_write_RSA_PUBKEY PEM_write_X509 PEM_write_X509_AUX PEM_write_X509_CRL PEM_write_X509_REQ PEM_write_X509_REQ_NEW PEM_write_bio PEM_write_bio_ASN1_stream PEM_write_bio_CMS PEM_write_bio_CMS_stream PEM_write_bio_DHparams PEM_write_bio_DHxparams PEM_write_bio_DSAPrivateKey PEM_write_bio_DSA_PUBKEY PEM_write_bio_DSAparams PEM_write_bio_ECPKParameters PEM_write_bio_ECPrivateKey PEM_write_bio_EC_PUBKEY PEM_write_bio_NETSCAPE_CERT_SEQUENCE PEM_write_bio_PKCS7 PEM_write_bio_PKCS7_stream PEM_write_bio_PKCS8 PEM_write_bio_PKCS8PrivateKey PEM_write_bio_PKCS8PrivateKey_nid PEM_write_bio_PKCS8_PRIV_KEY_INFO PEM_write_bio_PUBKEY PEM_write_bio_Parameters PEM_write_bio_PrivateKey PEM_write_bio_PrivateKey_traditional PEM_write_bio_RSAPrivateKey PEM_write_bio_RSAPublicKey PEM_write_bio_RSA_PUBKEY PEM_write_bio_X509 PEM_write_bio_X509_AUX PEM_write_bio_X509_CRL PEM_write_bio_X509_REQ PEM_write_bio_X509_REQ_NEW PKCS12_AUTHSAFES_it PKCS12_BAGS_free PKCS12_BAGS_it PKCS12_BAGS_new PKCS12_MAC_DATA_free PKCS12_MAC_DATA_it PKCS12_MAC_DATA_new PKCS12_PBE_add PKCS12_PBE_keyivgen PKCS12_SAFEBAGS_it PKCS12_SAFEBAG_create0_p8inf PKCS12_SAFEBAG_create0_pkcs8 PKCS12_SAFEBAG_create_cert PKCS12_SAFEBAG_create_crl PKCS12_SAFEBAG_create_pkcs8_encrypt PKCS12_SAFEBAG_free PKCS12_SAFEBAG_get0_attr PKCS12_SAFEBAG_get0_attrs PKCS12_SAFEBAG_get0_p8inf PKCS12_SAFEBAG_get0_pkcs8 PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_type PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get1_crl PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_it PKCS12_SAFEBAG_new PKCS12_add_CSPName_asc PKCS12_add_cert PKCS12_add_friendlyname_asc PKCS12_add_friendlyname_uni PKCS12_add_friendlyname_utf8 PKCS12_add_key PKCS12_add_localkeyid PKCS12_add_safe PKCS12_add_safes PKCS12_create PKCS12_decrypt_skey PKCS12_free PKCS12_gen_mac PKCS12_get0_mac PKCS12_get_attr PKCS12_get_attr_gen PKCS12_get_friendlyname PKCS12_init PKCS12_it PKCS12_item_decrypt_d2i PKCS12_item_i2d_encrypt PKCS12_item_pack_safebag PKCS12_key_gen_asc PKCS12_key_gen_uni PKCS12_key_gen_utf8 PKCS12_mac_present PKCS12_new PKCS12_newpass PKCS12_pack_authsafes PKCS12_pack_p7data PKCS12_pack_p7encdata PKCS12_parse PKCS12_pbe_crypt PKCS12_set_mac PKCS12_setup_mac PKCS12_unpack_authsafes PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_verify_mac PKCS1_MGF1 PKCS5_PBE_add PKCS5_PBE_keyivgen PKCS5_PBKDF2_HMAC PKCS5_PBKDF2_HMAC_SHA1 PKCS5_pbe2_set PKCS5_pbe2_set_iv PKCS5_pbe2_set_scrypt PKCS5_pbe_set PKCS5_pbe_set0_algor PKCS5_pbkdf2_set PKCS5_v2_PBE_keyivgen PKCS5_v2_scrypt_keyivgen PKCS7_ATTR_SIGN_it PKCS7_ATTR_VERIFY_it PKCS7_DIGEST_free PKCS7_DIGEST_it PKCS7_DIGEST_new PKCS7_ENCRYPT_free PKCS7_ENCRYPT_it PKCS7_ENCRYPT_new PKCS7_ENC_CONTENT_free PKCS7_ENC_CONTENT_it PKCS7_ENC_CONTENT_new PKCS7_ENVELOPE_free PKCS7_ENVELOPE_it PKCS7_ENVELOPE_new PKCS7_ISSUER_AND_SERIAL_digest PKCS7_ISSUER_AND_SERIAL_free PKCS7_ISSUER_AND_SERIAL_it PKCS7_ISSUER_AND_SERIAL_new PKCS7_RECIP_INFO_free PKCS7_RECIP_INFO_get0_alg PKCS7_RECIP_INFO_it PKCS7_RECIP_INFO_new PKCS7_RECIP_INFO_set PKCS7_SIGNED_free PKCS7_SIGNED_it PKCS7_SIGNED_new PKCS7_SIGNER_INFO_free PKCS7_SIGNER_INFO_get0_algs PKCS7_SIGNER_INFO_it PKCS7_SIGNER_INFO_new PKCS7_SIGNER_INFO_set PKCS7_SIGNER_INFO_sign PKCS7_SIGN_ENVELOPE_free PKCS7_SIGN_ENVELOPE_it PKCS7_SIGN_ENVELOPE_new PKCS7_add0_attrib_signing_time PKCS7_add1_attrib_digest PKCS7_add_attrib_content_type PKCS7_add_attrib_smimecap PKCS7_add_attribute PKCS7_add_certificate PKCS7_add_crl PKCS7_add_recipient PKCS7_add_recipient_info PKCS7_add_signature PKCS7_add_signed_attribute PKCS7_add_signer PKCS7_cert_from_signer_info PKCS7_content_new PKCS7_ctrl PKCS7_dataDecode PKCS7_dataFinal PKCS7_dataInit PKCS7_dataVerify PKCS7_decrypt PKCS7_digest_from_attributes PKCS7_dup PKCS7_encrypt PKCS7_final PKCS7_free PKCS7_get0_signers PKCS7_get_attribute PKCS7_get_issuer_and_serial PKCS7_get_signed_attribute PKCS7_get_signer_info PKCS7_get_smimecap PKCS7_it PKCS7_new PKCS7_print_ctx PKCS7_set0_type_other PKCS7_set_attributes PKCS7_set_cipher PKCS7_set_content PKCS7_set_digest PKCS7_set_signed_attributes PKCS7_set_type PKCS7_sign PKCS7_sign_add_signer PKCS7_signatureVerify PKCS7_simple_smimecap PKCS7_stream PKCS7_to_TS_TST_INFO PKCS7_verify PKCS8_PRIV_KEY_INFO_free PKCS8_PRIV_KEY_INFO_it PKCS8_PRIV_KEY_INFO_new PKCS8_add_keyusage PKCS8_decrypt PKCS8_encrypt PKCS8_get_attr PKCS8_pkey_add1_attr_by_NID PKCS8_pkey_get0 PKCS8_pkey_get0_attrs PKCS8_pkey_set0 PKCS8_set0_pbe PKEY_USAGE_PERIOD_free PKEY_USAGE_PERIOD_it PKEY_USAGE_PERIOD_new POLICYINFO_free POLICYINFO_it POLICYINFO_new POLICYQUALINFO_free POLICYQUALINFO_it POLICYQUALINFO_new POLICY_CONSTRAINTS_free POLICY_CONSTRAINTS_it POLICY_CONSTRAINTS_new POLICY_MAPPINGS_it POLICY_MAPPING_free POLICY_MAPPING_it POLICY_MAPPING_new PROFESSION_INFO_free PROFESSION_INFO_get0_addProfessionInfo PROFESSION_INFO_get0_namingAuthority PROFESSION_INFO_get0_professionItems PROFESSION_INFO_get0_professionOIDs PROFESSION_INFO_get0_registrationNumber PROFESSION_INFO_it PROFESSION_INFO_new PROFESSION_INFO_set0_addProfessionInfo PROFESSION_INFO_set0_namingAuthority PROFESSION_INFO_set0_professionItems PROFESSION_INFO_set0_professionOIDs PROFESSION_INFO_set0_registrationNumber PROXY_CERT_INFO_EXTENSION_free PROXY_CERT_INFO_EXTENSION_it PROXY_CERT_INFO_EXTENSION_new PROXY_POLICY_free PROXY_POLICY_it PROXY_POLICY_new RAND_DRBG_bytes RAND_DRBG_free RAND_DRBG_generate RAND_DRBG_get0_master RAND_DRBG_get0_private RAND_DRBG_get0_public RAND_DRBG_get_ex_data RAND_DRBG_instantiate RAND_DRBG_new RAND_DRBG_reseed RAND_DRBG_secure_new RAND_DRBG_set RAND_DRBG_set_callbacks RAND_DRBG_set_defaults RAND_DRBG_set_ex_data RAND_DRBG_set_reseed_defaults RAND_DRBG_set_reseed_interval RAND_DRBG_set_reseed_time_interval RAND_DRBG_uninstantiate RAND_OpenSSL RAND_add RAND_bytes RAND_event RAND_file_name RAND_get_rand_method RAND_keep_random_devices_open RAND_load_file RAND_poll RAND_priv_bytes RAND_pseudo_bytes RAND_screen RAND_seed RAND_set_rand_engine RAND_set_rand_method RAND_status RAND_write_file RC2_cbc_encrypt RC2_cfb64_encrypt RC2_decrypt RC2_ecb_encrypt RC2_encrypt RC2_ofb64_encrypt RC2_set_key RC4 RC4_options RC4_set_key RIPEMD160 RIPEMD160_Final RIPEMD160_Init RIPEMD160_Transform RIPEMD160_Update RSAPrivateKey_dup RSAPrivateKey_it RSAPublicKey_dup RSAPublicKey_it RSA_OAEP_PARAMS_free RSA_OAEP_PARAMS_it RSA_OAEP_PARAMS_new RSA_PKCS1_OpenSSL RSA_PSS_PARAMS_free RSA_PSS_PARAMS_it RSA_PSS_PARAMS_new RSA_X931_derive_ex RSA_X931_generate_key_ex RSA_X931_hash_id RSA_bits RSA_blinding_off RSA_blinding_on RSA_check_key RSA_check_key_ex RSA_clear_flags RSA_flags RSA_free RSA_generate_key RSA_generate_key_ex RSA_generate_multi_prime_key RSA_get0_crt_params RSA_get0_d RSA_get0_dmp1 RSA_get0_dmq1 RSA_get0_e RSA_get0_engine RSA_get0_factors RSA_get0_iqmp RSA_get0_key RSA_get0_multi_prime_crt_params RSA_get0_multi_prime_factors RSA_get0_n RSA_get0_p RSA_get0_q RSA_get_default_method RSA_get_ex_data RSA_get_method RSA_get_multi_prime_extra_count RSA_get_version RSA_meth_dup RSA_meth_free RSA_meth_get0_app_data RSA_meth_get0_name RSA_meth_get_bn_mod_exp RSA_meth_get_finish RSA_meth_get_flags RSA_meth_get_init RSA_meth_get_keygen RSA_meth_get_mod_exp RSA_meth_get_multi_prime_keygen RSA_meth_get_priv_dec RSA_meth_get_priv_enc RSA_meth_get_pub_dec RSA_meth_get_pub_enc RSA_meth_get_sign RSA_meth_get_verify RSA_meth_new RSA_meth_set0_app_data RSA_meth_set1_name RSA_meth_set_bn_mod_exp RSA_meth_set_finish RSA_meth_set_flags RSA_meth_set_init RSA_meth_set_keygen RSA_meth_set_mod_exp RSA_meth_set_multi_prime_keygen RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_meth_set_pub_dec RSA_meth_set_pub_enc RSA_meth_set_sign RSA_meth_set_verify RSA_new RSA_new_method RSA_null_method RSA_padding_add_PKCS1_OAEP RSA_padding_add_PKCS1_OAEP_mgf1 RSA_padding_add_PKCS1_PSS RSA_padding_add_PKCS1_PSS_mgf1 RSA_padding_add_PKCS1_type_1 RSA_padding_add_PKCS1_type_2 RSA_padding_add_SSLv23 RSA_padding_add_X931 RSA_padding_add_none RSA_padding_check_PKCS1_OAEP RSA_padding_check_PKCS1_OAEP_mgf1 RSA_padding_check_PKCS1_type_1 RSA_padding_check_PKCS1_type_2 RSA_padding_check_SSLv23 RSA_padding_check_X931 RSA_padding_check_none RSA_pkey_ctx_ctrl RSA_print RSA_print_fp RSA_private_decrypt RSA_private_encrypt RSA_public_decrypt RSA_public_encrypt RSA_security_bits RSA_set0_crt_params RSA_set0_factors RSA_set0_key RSA_set0_multi_prime_params RSA_set_default_method RSA_set_ex_data RSA_set_flags RSA_set_method RSA_setup_blinding RSA_sign RSA_sign_ASN1_OCTET_STRING RSA_size RSA_test_flags RSA_up_ref RSA_verify RSA_verify_ASN1_OCTET_STRING RSA_verify_PKCS1_PSS RSA_verify_PKCS1_PSS_mgf1 SCRYPT_PARAMS_free SCRYPT_PARAMS_it SCRYPT_PARAMS_new SCT_LIST_free SCT_LIST_print SCT_LIST_validate SCT_free SCT_get0_extensions SCT_get0_log_id SCT_get0_signature SCT_get_log_entry_type SCT_get_signature_nid SCT_get_source SCT_get_timestamp SCT_get_validation_status SCT_get_version SCT_new SCT_new_from_base64 SCT_print SCT_set0_extensions SCT_set0_log_id SCT_set0_signature SCT_set1_extensions SCT_set1_log_id SCT_set1_signature SCT_set_log_entry_type SCT_set_signature_nid SCT_set_source SCT_set_timestamp SCT_set_version SCT_validate SCT_validation_status_string SEED_cbc_encrypt SEED_cfb128_encrypt SEED_decrypt SEED_ecb_encrypt SEED_encrypt SEED_ofb128_encrypt SEED_set_key SHA1 SHA1_Final SHA1_Init SHA1_Transform SHA1_Update SHA224 SHA224_Final SHA224_Init SHA224_Update SHA256 SHA256_Final SHA256_Init SHA256_Transform SHA256_Update SHA384 SHA384_Final SHA384_Init SHA384_Update SHA512 SHA512_Final SHA512_Init SHA512_Transform SHA512_Update SMIME_crlf_copy SMIME_read_ASN1 SMIME_read_CMS SMIME_read_PKCS7 SMIME_text SMIME_write_ASN1 SMIME_write_CMS SMIME_write_PKCS7 SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_VBASE_free SRP_VBASE_get1_by_user SRP_VBASE_get_by_user SRP_VBASE_init SRP_VBASE_new SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier SRP_create_verifier_BN SRP_get_default_gN SRP_user_pwd_free SXNETID_free SXNETID_it SXNETID_new SXNET_add_id_INTEGER SXNET_add_id_asc SXNET_add_id_ulong SXNET_free SXNET_get_id_INTEGER SXNET_get_id_asc SXNET_get_id_ulong SXNET_it SXNET_new TLS_FEATURE_free TLS_FEATURE_new TS_ACCURACY_dup TS_ACCURACY_free TS_ACCURACY_get_micros TS_ACCURACY_get_millis TS_ACCURACY_get_seconds TS_ACCURACY_new TS_ACCURACY_set_micros TS_ACCURACY_set_millis TS_ACCURACY_set_seconds TS_ASN1_INTEGER_print_bio TS_CONF_get_tsa_section TS_CONF_load_cert TS_CONF_load_certs TS_CONF_load_key TS_CONF_set_accuracy TS_CONF_set_certs TS_CONF_set_clock_precision_digits TS_CONF_set_crypto_device TS_CONF_set_def_policy TS_CONF_set_default_engine TS_CONF_set_digests TS_CONF_set_ess_cert_id_chain TS_CONF_set_ess_cert_id_digest TS_CONF_set_ordering TS_CONF_set_policies TS_CONF_set_serial TS_CONF_set_signer_cert TS_CONF_set_signer_digest TS_CONF_set_signer_key TS_CONF_set_tsa_name TS_MSG_IMPRINT_dup TS_MSG_IMPRINT_free TS_MSG_IMPRINT_get_algo TS_MSG_IMPRINT_get_msg TS_MSG_IMPRINT_new TS_MSG_IMPRINT_print_bio TS_MSG_IMPRINT_set_algo TS_MSG_IMPRINT_set_msg TS_OBJ_print_bio TS_REQ_add_ext TS_REQ_delete_ext TS_REQ_dup TS_REQ_ext_free TS_REQ_free TS_REQ_get_cert_req TS_REQ_get_ext TS_REQ_get_ext_by_NID TS_REQ_get_ext_by_OBJ TS_REQ_get_ext_by_critical TS_REQ_get_ext_count TS_REQ_get_ext_d2i TS_REQ_get_exts TS_REQ_get_msg_imprint TS_REQ_get_nonce TS_REQ_get_policy_id TS_REQ_get_version TS_REQ_new TS_REQ_print_bio TS_REQ_set_cert_req TS_REQ_set_msg_imprint TS_REQ_set_nonce TS_REQ_set_policy_id TS_REQ_set_version TS_REQ_to_TS_VERIFY_CTX TS_RESP_CTX_add_failure_info TS_RESP_CTX_add_flags TS_RESP_CTX_add_md TS_RESP_CTX_add_policy TS_RESP_CTX_free TS_RESP_CTX_get_request TS_RESP_CTX_get_tst_info TS_RESP_CTX_new TS_RESP_CTX_set_accuracy TS_RESP_CTX_set_certs TS_RESP_CTX_set_clock_precision_digits TS_RESP_CTX_set_def_policy TS_RESP_CTX_set_ess_cert_id_digest TS_RESP_CTX_set_extension_cb TS_RESP_CTX_set_serial_cb TS_RESP_CTX_set_signer_cert TS_RESP_CTX_set_signer_digest TS_RESP_CTX_set_signer_key TS_RESP_CTX_set_status_info TS_RESP_CTX_set_status_info_cond TS_RESP_CTX_set_time_cb TS_RESP_create_response TS_RESP_dup TS_RESP_free TS_RESP_get_status_info TS_RESP_get_token TS_RESP_get_tst_info TS_RESP_new TS_RESP_print_bio TS_RESP_set_status_info TS_RESP_set_tst_info TS_RESP_verify_response TS_RESP_verify_signature TS_RESP_verify_token TS_STATUS_INFO_dup TS_STATUS_INFO_free TS_STATUS_INFO_get0_failure_info TS_STATUS_INFO_get0_status TS_STATUS_INFO_get0_text TS_STATUS_INFO_new TS_STATUS_INFO_print_bio TS_STATUS_INFO_set_status TS_TST_INFO_add_ext TS_TST_INFO_delete_ext TS_TST_INFO_dup TS_TST_INFO_ext_free TS_TST_INFO_free TS_TST_INFO_get_accuracy TS_TST_INFO_get_ext TS_TST_INFO_get_ext_by_NID TS_TST_INFO_get_ext_by_OBJ TS_TST_INFO_get_ext_by_critical TS_TST_INFO_get_ext_count TS_TST_INFO_get_ext_d2i TS_TST_INFO_get_exts TS_TST_INFO_get_msg_imprint TS_TST_INFO_get_nonce TS_TST_INFO_get_ordering TS_TST_INFO_get_policy_id TS_TST_INFO_get_serial TS_TST_INFO_get_time TS_TST_INFO_get_tsa TS_TST_INFO_get_version TS_TST_INFO_new TS_TST_INFO_print_bio TS_TST_INFO_set_accuracy TS_TST_INFO_set_msg_imprint TS_TST_INFO_set_nonce TS_TST_INFO_set_ordering TS_TST_INFO_set_policy_id TS_TST_INFO_set_serial TS_TST_INFO_set_time TS_TST_INFO_set_tsa TS_TST_INFO_set_version TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_add_flags TS_VERIFY_CTX_cleanup TS_VERIFY_CTX_free TS_VERIFY_CTX_init TS_VERIFY_CTX_new TS_VERIFY_CTX_set_data TS_VERIFY_CTX_set_flags TS_VERIFY_CTX_set_imprint TS_VERIFY_CTX_set_store TS_X509_ALGOR_print_bio TS_ext_print_bio TXT_DB_create_index TXT_DB_free TXT_DB_get_by_index TXT_DB_insert TXT_DB_read TXT_DB_write UINT32_it UINT64_it UI_OpenSSL UI_UTIL_read_pw UI_UTIL_read_pw_string UI_UTIL_wrap_read_pem_callback UI_add_error_string UI_add_info_string UI_add_input_boolean UI_add_input_string UI_add_user_data UI_add_verify_string UI_construct_prompt UI_create_method UI_ctrl UI_destroy_method UI_dup_error_string UI_dup_info_string UI_dup_input_boolean UI_dup_input_string UI_dup_user_data UI_dup_verify_string UI_free UI_get0_action_string UI_get0_output_string UI_get0_result UI_get0_result_string UI_get0_test_string UI_get0_user_data UI_get_default_method UI_get_ex_data UI_get_input_flags UI_get_method UI_get_result_length UI_get_result_maxsize UI_get_result_minsize UI_get_result_string_length UI_get_string_type UI_method_get_closer UI_method_get_data_destructor UI_method_get_data_duplicator UI_method_get_ex_data UI_method_get_flusher UI_method_get_opener UI_method_get_prompt_constructor UI_method_get_reader UI_method_get_writer UI_method_set_closer UI_method_set_data_duplicator UI_method_set_ex_data UI_method_set_flusher UI_method_set_opener UI_method_set_prompt_constructor UI_method_set_reader UI_method_set_writer UI_new UI_new_method UI_null UI_process UI_set_default_method UI_set_ex_data UI_set_method UI_set_result UI_set_result_ex USERNOTICE_free USERNOTICE_it USERNOTICE_new UTF8_getc UTF8_putc WHIRLPOOL WHIRLPOOL_BitUpdate WHIRLPOOL_Final WHIRLPOOL_Init WHIRLPOOL_Update X509V3_EXT_CRL_add_conf X509V3_EXT_CRL_add_nconf X509V3_EXT_REQ_add_conf X509V3_EXT_REQ_add_nconf X509V3_EXT_add X509V3_EXT_add_alias X509V3_EXT_add_conf X509V3_EXT_add_list X509V3_EXT_add_nconf X509V3_EXT_add_nconf_sk X509V3_EXT_cleanup X509V3_EXT_conf X509V3_EXT_conf_nid X509V3_EXT_d2i X509V3_EXT_get X509V3_EXT_get_nid X509V3_EXT_i2d X509V3_EXT_nconf X509V3_EXT_nconf_nid X509V3_EXT_print X509V3_EXT_print_fp X509V3_EXT_val_prn X509V3_NAME_from_section X509V3_add1_i2d X509V3_add_standard_extensions X509V3_add_value X509V3_add_value_bool X509V3_add_value_bool_nf X509V3_add_value_int X509V3_add_value_uchar X509V3_conf_free X509V3_extensions_print X509V3_get_d2i X509V3_get_section X509V3_get_string X509V3_get_value_bool X509V3_get_value_int X509V3_parse_list X509V3_section_free X509V3_set_conf_lhash X509V3_set_ctx X509V3_set_nconf X509V3_string_free X509_ALGORS_it X509_ALGOR_cmp X509_ALGOR_dup X509_ALGOR_free X509_ALGOR_get0 X509_ALGOR_it X509_ALGOR_new X509_ALGOR_set0 X509_ALGOR_set_md X509_ATTRIBUTE_count X509_ATTRIBUTE_create X509_ATTRIBUTE_create_by_NID X509_ATTRIBUTE_create_by_OBJ X509_ATTRIBUTE_create_by_txt X509_ATTRIBUTE_dup X509_ATTRIBUTE_free X509_ATTRIBUTE_get0_data X509_ATTRIBUTE_get0_object X509_ATTRIBUTE_get0_type X509_ATTRIBUTE_it X509_ATTRIBUTE_new X509_ATTRIBUTE_set1_data X509_ATTRIBUTE_set1_object X509_CERT_AUX_free X509_CERT_AUX_it X509_CERT_AUX_new X509_CINF_free X509_CINF_it X509_CINF_new X509_CRL_INFO_free X509_CRL_INFO_it X509_CRL_INFO_new X509_CRL_METHOD_free X509_CRL_METHOD_new X509_CRL_add0_revoked X509_CRL_add1_ext_i2d X509_CRL_add_ext X509_CRL_check_suiteb X509_CRL_cmp X509_CRL_delete_ext X509_CRL_diff X509_CRL_digest X509_CRL_dup X509_CRL_free X509_CRL_get0_by_cert X509_CRL_get0_by_serial X509_CRL_get0_extensions X509_CRL_get0_lastUpdate X509_CRL_get0_nextUpdate X509_CRL_get0_signature X509_CRL_get_REVOKED X509_CRL_get_ext X509_CRL_get_ext_by_NID X509_CRL_get_ext_by_OBJ X509_CRL_get_ext_by_critical X509_CRL_get_ext_count X509_CRL_get_ext_d2i X509_CRL_get_issuer X509_CRL_get_lastUpdate X509_CRL_get_meth_data X509_CRL_get_nextUpdate X509_CRL_get_signature_nid X509_CRL_get_version X509_CRL_http_nbio X509_CRL_it X509_CRL_match X509_CRL_new X509_CRL_print X509_CRL_print_ex X509_CRL_print_fp X509_CRL_set1_lastUpdate X509_CRL_set1_nextUpdate X509_CRL_set_default_method X509_CRL_set_issuer_name X509_CRL_set_meth_data X509_CRL_set_version X509_CRL_sign X509_CRL_sign_ctx X509_CRL_sort X509_CRL_up_ref X509_CRL_verify X509_EXTENSIONS_it X509_EXTENSION_create_by_NID X509_EXTENSION_create_by_OBJ X509_EXTENSION_dup X509_EXTENSION_free X509_EXTENSION_get_critical X509_EXTENSION_get_data X509_EXTENSION_get_object X509_EXTENSION_it X509_EXTENSION_new X509_EXTENSION_set_critical X509_EXTENSION_set_data X509_EXTENSION_set_object X509_INFO_free X509_INFO_new X509_LOOKUP_by_alias X509_LOOKUP_by_fingerprint X509_LOOKUP_by_issuer_serial X509_LOOKUP_by_subject X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_free X509_LOOKUP_get_method_data X509_LOOKUP_get_store X509_LOOKUP_hash_dir X509_LOOKUP_init X509_LOOKUP_meth_free X509_LOOKUP_meth_get_ctrl X509_LOOKUP_meth_get_free X509_LOOKUP_meth_get_get_by_alias X509_LOOKUP_meth_get_get_by_fingerprint X509_LOOKUP_meth_get_get_by_issuer_serial X509_LOOKUP_meth_get_get_by_subject X509_LOOKUP_meth_get_init X509_LOOKUP_meth_get_new_item X509_LOOKUP_meth_get_shutdown X509_LOOKUP_meth_new X509_LOOKUP_meth_set_ctrl X509_LOOKUP_meth_set_free X509_LOOKUP_meth_set_get_by_alias X509_LOOKUP_meth_set_get_by_fingerprint X509_LOOKUP_meth_set_get_by_issuer_serial X509_LOOKUP_meth_set_get_by_subject X509_LOOKUP_meth_set_init X509_LOOKUP_meth_set_new_item X509_LOOKUP_meth_set_shutdown X509_LOOKUP_new X509_LOOKUP_set_method_data X509_LOOKUP_shutdown X509_NAME_ENTRY_create_by_NID X509_NAME_ENTRY_create_by_OBJ X509_NAME_ENTRY_create_by_txt X509_NAME_ENTRY_dup X509_NAME_ENTRY_free X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_ENTRY_it X509_NAME_ENTRY_new X509_NAME_ENTRY_set X509_NAME_ENTRY_set_data X509_NAME_ENTRY_set_object X509_NAME_add_entry X509_NAME_add_entry_by_NID X509_NAME_add_entry_by_OBJ X509_NAME_add_entry_by_txt X509_NAME_cmp X509_NAME_delete_entry X509_NAME_digest X509_NAME_dup X509_NAME_entry_count X509_NAME_free X509_NAME_get0_der X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_get_text_by_NID X509_NAME_get_text_by_OBJ X509_NAME_hash X509_NAME_hash_old X509_NAME_it X509_NAME_new X509_NAME_oneline X509_NAME_print X509_NAME_print_ex X509_NAME_print_ex_fp X509_NAME_set X509_OBJECT_free X509_OBJECT_get0_X509 X509_OBJECT_get0_X509_CRL X509_OBJECT_get_type X509_OBJECT_idx_by_subject X509_OBJECT_new X509_OBJECT_retrieve_by_subject X509_OBJECT_retrieve_match X509_OBJECT_set1_X509 X509_OBJECT_set1_X509_CRL X509_OBJECT_up_ref_count X509_PKEY_free X509_PKEY_new X509_POLICY_NODE_print X509_PUBKEY_free X509_PUBKEY_get X509_PUBKEY_get0 X509_PUBKEY_get0_param X509_PUBKEY_it X509_PUBKEY_new X509_PUBKEY_set X509_PUBKEY_set0_param X509_PURPOSE_add X509_PURPOSE_cleanup X509_PURPOSE_get0 X509_PURPOSE_get0_name X509_PURPOSE_get0_sname X509_PURPOSE_get_by_id X509_PURPOSE_get_by_sname X509_PURPOSE_get_count X509_PURPOSE_get_id X509_PURPOSE_get_trust X509_PURPOSE_set X509_REQ_INFO_free X509_REQ_INFO_it X509_REQ_INFO_new X509_REQ_add1_attr X509_REQ_add1_attr_by_NID X509_REQ_add1_attr_by_OBJ X509_REQ_add1_attr_by_txt X509_REQ_add_extensions X509_REQ_add_extensions_nid X509_REQ_check_private_key X509_REQ_delete_attr X509_REQ_digest X509_REQ_dup X509_REQ_extension_nid X509_REQ_free X509_REQ_get0_pubkey X509_REQ_get0_signature X509_REQ_get1_email X509_REQ_get_X509_PUBKEY X509_REQ_get_attr X509_REQ_get_attr_by_NID X509_REQ_get_attr_by_OBJ X509_REQ_get_attr_count X509_REQ_get_extension_nids X509_REQ_get_extensions X509_REQ_get_pubkey X509_REQ_get_signature_nid X509_REQ_get_subject_name X509_REQ_get_version X509_REQ_it X509_REQ_new X509_REQ_print X509_REQ_print_ex X509_REQ_print_fp X509_REQ_set_extension_nids X509_REQ_set_pubkey X509_REQ_set_subject_name X509_REQ_set_version X509_REQ_sign X509_REQ_sign_ctx X509_REQ_to_X509 X509_REQ_verify X509_REVOKED_add1_ext_i2d X509_REVOKED_add_ext X509_REVOKED_delete_ext X509_REVOKED_dup X509_REVOKED_free X509_REVOKED_get0_extensions X509_REVOKED_get0_revocationDate X509_REVOKED_get0_serialNumber X509_REVOKED_get_ext X509_REVOKED_get_ext_by_NID X509_REVOKED_get_ext_by_OBJ X509_REVOKED_get_ext_by_critical X509_REVOKED_get_ext_count X509_REVOKED_get_ext_d2i X509_REVOKED_it X509_REVOKED_new X509_REVOKED_set_revocationDate X509_REVOKED_set_serialNumber X509_SIG_INFO_get X509_SIG_INFO_set X509_SIG_free X509_SIG_get0 X509_SIG_getm X509_SIG_it X509_SIG_new X509_STORE_CTX_cleanup X509_STORE_CTX_free X509_STORE_CTX_get0_cert X509_STORE_CTX_get0_chain X509_STORE_CTX_get0_current_crl X509_STORE_CTX_get0_current_issuer X509_STORE_CTX_get0_param X509_STORE_CTX_get0_parent_ctx X509_STORE_CTX_get0_policy_tree X509_STORE_CTX_get0_store X509_STORE_CTX_get0_untrusted X509_STORE_CTX_get1_certs X509_STORE_CTX_get1_chain X509_STORE_CTX_get1_crls X509_STORE_CTX_get1_issuer X509_STORE_CTX_get_by_subject X509_STORE_CTX_get_cert_crl X509_STORE_CTX_get_check_crl X509_STORE_CTX_get_check_issued X509_STORE_CTX_get_check_policy X509_STORE_CTX_get_check_revocation X509_STORE_CTX_get_cleanup X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_ex_data X509_STORE_CTX_get_explicit_policy X509_STORE_CTX_get_get_crl X509_STORE_CTX_get_get_issuer X509_STORE_CTX_get_lookup_certs X509_STORE_CTX_get_lookup_crls X509_STORE_CTX_get_num_untrusted X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_get_verify X509_STORE_CTX_get_verify_cb X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_purpose_inherit X509_STORE_CTX_set0_crls X509_STORE_CTX_set0_dane X509_STORE_CTX_set0_param X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_set0_untrusted X509_STORE_CTX_set0_verified_chain X509_STORE_CTX_set_cert X509_STORE_CTX_set_current_cert X509_STORE_CTX_set_default X509_STORE_CTX_set_depth X509_STORE_CTX_set_error X509_STORE_CTX_set_error_depth X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_flags X509_STORE_CTX_set_purpose X509_STORE_CTX_set_time X509_STORE_CTX_set_trust X509_STORE_CTX_set_verify X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_free X509_STORE_get0_objects X509_STORE_get0_param X509_STORE_get_cert_crl X509_STORE_get_check_crl X509_STORE_get_check_issued X509_STORE_get_check_policy X509_STORE_get_check_revocation X509_STORE_get_cleanup X509_STORE_get_ex_data X509_STORE_get_get_crl X509_STORE_get_get_issuer X509_STORE_get_lookup_certs X509_STORE_get_lookup_crls X509_STORE_get_verify X509_STORE_get_verify_cb X509_STORE_load_locations X509_STORE_lock X509_STORE_new X509_STORE_set1_param X509_STORE_set_cert_crl X509_STORE_set_check_crl X509_STORE_set_check_issued X509_STORE_set_check_policy X509_STORE_set_check_revocation X509_STORE_set_cleanup X509_STORE_set_default_paths X509_STORE_set_depth X509_STORE_set_ex_data X509_STORE_set_flags X509_STORE_set_get_crl X509_STORE_set_get_issuer X509_STORE_set_lookup_certs X509_STORE_set_lookup_crls X509_STORE_set_purpose X509_STORE_set_trust X509_STORE_set_verify X509_STORE_set_verify_cb X509_STORE_unlock X509_STORE_up_ref X509_TRUST_add X509_TRUST_cleanup X509_TRUST_get0 X509_TRUST_get0_name X509_TRUST_get_by_id X509_TRUST_get_count X509_TRUST_get_flags X509_TRUST_get_trust X509_TRUST_set X509_TRUST_set_default X509_VAL_free X509_VAL_it X509_VAL_new X509_VERIFY_PARAM_add0_policy X509_VERIFY_PARAM_add0_table X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_clear_flags X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0 X509_VERIFY_PARAM_get0_name X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_auth_level X509_VERIFY_PARAM_get_count X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_get_flags X509_VERIFY_PARAM_get_hostflags X509_VERIFY_PARAM_get_inh_flags X509_VERIFY_PARAM_get_time X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_lookup X509_VERIFY_PARAM_move_peername X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_email X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set1_ip X509_VERIFY_PARAM_set1_ip_asc X509_VERIFY_PARAM_set1_name X509_VERIFY_PARAM_set1_policies X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_flags X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_set_inh_flags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_time X509_VERIFY_PARAM_set_trust X509_VERIFY_PARAM_table_cleanup X509_add1_ext_i2d X509_add1_reject_object X509_add1_trust_object X509_add_ext X509_alias_get0 X509_alias_set1 X509_aux_print X509_certificate_type X509_chain_check_suiteb X509_chain_up_ref X509_check_akid X509_check_ca X509_check_email X509_check_host X509_check_ip X509_check_ip_asc X509_check_issued X509_check_private_key X509_check_purpose X509_check_trust X509_cmp X509_cmp_current_time X509_cmp_time X509_delete_ext X509_digest X509_dup X509_email_free X509_find_by_issuer_and_serial X509_find_by_subject X509_free X509_get0_authority_issuer X509_get0_authority_key_id X509_get0_authority_serial X509_get0_extensions X509_get0_notAfter X509_get0_notBefore X509_get0_pubkey X509_get0_pubkey_bitstr X509_get0_reject_objects X509_get0_serialNumber X509_get0_signature X509_get0_subject_key_id X509_get0_tbs_sigalg X509_get0_trust_objects X509_get0_uids X509_get1_email X509_get1_ocsp X509_get_X509_PUBKEY X509_get_default_cert_area X509_get_default_cert_dir X509_get_default_cert_dir_env X509_get_default_cert_file X509_get_default_cert_file_env X509_get_default_private_dir X509_get_ex_data X509_get_ext X509_get_ext_by_NID X509_get_ext_by_OBJ X509_get_ext_by_critical X509_get_ext_count X509_get_ext_d2i X509_get_extended_key_usage X509_get_extension_flags X509_get_issuer_name X509_get_key_usage X509_get_pathlen X509_get_proxy_pathlen X509_get_pubkey X509_get_pubkey_parameters X509_get_serialNumber X509_get_signature_info X509_get_signature_nid X509_get_signature_type X509_get_subject_name X509_get_version X509_getm_notAfter X509_getm_notBefore X509_gmtime_adj X509_http_nbio X509_issuer_and_serial_cmp X509_issuer_and_serial_hash X509_issuer_name_cmp X509_issuer_name_hash X509_issuer_name_hash_old X509_it X509_keyid_get0 X509_keyid_set1 X509_load_cert_crl_file X509_load_cert_file X509_load_crl_file X509_new X509_ocspid_print X509_policy_check X509_policy_level_get0_node X509_policy_level_node_count X509_policy_node_get0_parent X509_policy_node_get0_policy X509_policy_node_get0_qualifiers X509_policy_tree_free X509_policy_tree_get0_level X509_policy_tree_get0_policies X509_policy_tree_get0_user_policies X509_policy_tree_level_count X509_print X509_print_ex X509_print_ex_fp X509_print_fp X509_pubkey_digest X509_reject_clear X509_set1_notAfter X509_set1_notBefore X509_set_ex_data X509_set_issuer_name X509_set_proxy_flag X509_set_proxy_pathlen X509_set_pubkey X509_set_serialNumber X509_set_subject_name X509_set_version X509_sign X509_sign_ctx X509_signature_dump X509_signature_print X509_subject_name_cmp X509_subject_name_hash X509_subject_name_hash_old X509_supported_extension X509_time_adj X509_time_adj_ex X509_to_X509_REQ X509_trust_clear X509_trusted X509_up_ref X509_verify X509_verify_cert X509_verify_cert_error_string X509at_add1_attr X509at_add1_attr_by_NID X509at_add1_attr_by_OBJ X509at_add1_attr_by_txt X509at_delete_attr X509at_get0_data_by_OBJ X509at_get_attr X509at_get_attr_by_NID X509at_get_attr_by_OBJ X509at_get_attr_count X509v3_add_ext X509v3_addr_add_inherit X509v3_addr_add_prefix X509v3_addr_add_range X509v3_addr_canonize X509v3_addr_get_afi X509v3_addr_get_range X509v3_addr_inherits X509v3_addr_is_canonical X509v3_addr_subset X509v3_addr_validate_path X509v3_addr_validate_resource_set X509v3_asid_add_id_or_range X509v3_asid_add_inherit X509v3_asid_canonize X509v3_asid_inherits X509v3_asid_is_canonical X509v3_asid_subset X509v3_asid_validate_path X509v3_asid_validate_resource_set X509v3_delete_ext X509v3_get_ext X509v3_get_ext_by_NID X509v3_get_ext_by_OBJ X509v3_get_ext_by_critical X509v3_get_ext_count ZINT32_it ZINT64_it ZLONG_it ZUINT32_it ZUINT64_it _shadow_DES_check_key a2d_ASN1_OBJECT a2i_ASN1_ENUMERATED a2i_ASN1_INTEGER a2i_ASN1_STRING a2i_GENERAL_NAME a2i_IPADDRESS a2i_IPADDRESS_NC b2i_PVK_bio b2i_PrivateKey b2i_PrivateKey_bio b2i_PublicKey b2i_PublicKey_bio conf_ssl_get conf_ssl_get_cmd conf_ssl_name_find d2i_ACCESS_DESCRIPTION d2i_ADMISSIONS d2i_ADMISSION_SYNTAX d2i_ASIdOrRange d2i_ASIdentifierChoice d2i_ASIdentifiers d2i_ASN1_BIT_STRING d2i_ASN1_BMPSTRING d2i_ASN1_ENUMERATED d2i_ASN1_GENERALIZEDTIME d2i_ASN1_GENERALSTRING d2i_ASN1_IA5STRING d2i_ASN1_INTEGER d2i_ASN1_NULL d2i_ASN1_OBJECT d2i_ASN1_OCTET_STRING d2i_ASN1_PRINTABLE d2i_ASN1_PRINTABLESTRING d2i_ASN1_SEQUENCE_ANY d2i_ASN1_SET_ANY d2i_ASN1_T61STRING d2i_ASN1_TIME d2i_ASN1_TYPE d2i_ASN1_UINTEGER d2i_ASN1_UNIVERSALSTRING d2i_ASN1_UTCTIME d2i_ASN1_UTF8STRING d2i_ASN1_VISIBLESTRING d2i_ASRange d2i_AUTHORITY_INFO_ACCESS d2i_AUTHORITY_KEYID d2i_AutoPrivateKey d2i_BASIC_CONSTRAINTS d2i_CERTIFICATEPOLICIES d2i_CMS_ContentInfo d2i_CMS_ReceiptRequest d2i_CMS_bio d2i_CRL_DIST_POINTS d2i_DHparams d2i_DHxparams d2i_DIRECTORYSTRING d2i_DISPLAYTEXT d2i_DIST_POINT d2i_DIST_POINT_NAME d2i_DSAPrivateKey d2i_DSAPrivateKey_bio d2i_DSAPrivateKey_fp d2i_DSAPublicKey d2i_DSA_PUBKEY d2i_DSA_PUBKEY_bio d2i_DSA_PUBKEY_fp d2i_DSA_SIG d2i_DSAparams d2i_ECDSA_SIG d2i_ECPKParameters d2i_ECParameters d2i_ECPrivateKey d2i_ECPrivateKey_bio d2i_ECPrivateKey_fp d2i_EC_PUBKEY d2i_EC_PUBKEY_bio d2i_EC_PUBKEY_fp d2i_EDIPARTYNAME d2i_ESS_CERT_ID d2i_ESS_CERT_ID_V2 d2i_ESS_ISSUER_SERIAL d2i_ESS_SIGNING_CERT d2i_ESS_SIGNING_CERT_V2 d2i_EXTENDED_KEY_USAGE d2i_GENERAL_NAME d2i_GENERAL_NAMES d2i_IPAddressChoice d2i_IPAddressFamily d2i_IPAddressOrRange d2i_IPAddressRange d2i_ISSUING_DIST_POINT d2i_NAMING_AUTHORITY d2i_NETSCAPE_CERT_SEQUENCE d2i_NETSCAPE_SPKAC d2i_NETSCAPE_SPKI d2i_NOTICEREF d2i_OCSP_BASICRESP d2i_OCSP_CERTID d2i_OCSP_CERTSTATUS d2i_OCSP_CRLID d2i_OCSP_ONEREQ d2i_OCSP_REQINFO d2i_OCSP_REQUEST d2i_OCSP_RESPBYTES d2i_OCSP_RESPDATA d2i_OCSP_RESPID d2i_OCSP_RESPONSE d2i_OCSP_REVOKEDINFO d2i_OCSP_SERVICELOC d2i_OCSP_SIGNATURE d2i_OCSP_SINGLERESP d2i_OTHERNAME d2i_PBE2PARAM d2i_PBEPARAM d2i_PBKDF2PARAM d2i_PKCS12 d2i_PKCS12_BAGS d2i_PKCS12_MAC_DATA d2i_PKCS12_SAFEBAG d2i_PKCS12_bio d2i_PKCS12_fp d2i_PKCS7 d2i_PKCS7_DIGEST d2i_PKCS7_ENCRYPT d2i_PKCS7_ENC_CONTENT d2i_PKCS7_ENVELOPE d2i_PKCS7_ISSUER_AND_SERIAL d2i_PKCS7_RECIP_INFO d2i_PKCS7_SIGNED d2i_PKCS7_SIGNER_INFO d2i_PKCS7_SIGN_ENVELOPE d2i_PKCS7_bio d2i_PKCS7_fp d2i_PKCS8PrivateKey_bio d2i_PKCS8PrivateKey_fp d2i_PKCS8_PRIV_KEY_INFO d2i_PKCS8_PRIV_KEY_INFO_bio d2i_PKCS8_PRIV_KEY_INFO_fp d2i_PKCS8_bio d2i_PKCS8_fp d2i_PKEY_USAGE_PERIOD d2i_POLICYINFO d2i_POLICYQUALINFO d2i_PROFESSION_INFO d2i_PROXY_CERT_INFO_EXTENSION d2i_PROXY_POLICY d2i_PUBKEY d2i_PUBKEY_bio d2i_PUBKEY_fp d2i_PrivateKey d2i_PrivateKey_bio d2i_PrivateKey_fp d2i_PublicKey d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_RSAPrivateKey_fp d2i_RSAPublicKey d2i_RSAPublicKey_bio d2i_RSAPublicKey_fp d2i_RSA_OAEP_PARAMS d2i_RSA_PSS_PARAMS d2i_RSA_PUBKEY d2i_RSA_PUBKEY_bio d2i_RSA_PUBKEY_fp d2i_SCRYPT_PARAMS d2i_SCT_LIST d2i_SXNET d2i_SXNETID d2i_TS_ACCURACY d2i_TS_MSG_IMPRINT d2i_TS_MSG_IMPRINT_bio d2i_TS_MSG_IMPRINT_fp d2i_TS_REQ d2i_TS_REQ_bio d2i_TS_REQ_fp d2i_TS_RESP d2i_TS_RESP_bio d2i_TS_RESP_fp d2i_TS_STATUS_INFO d2i_TS_TST_INFO d2i_TS_TST_INFO_bio d2i_TS_TST_INFO_fp d2i_USERNOTICE d2i_X509 d2i_X509_ALGOR d2i_X509_ALGORS d2i_X509_ATTRIBUTE d2i_X509_AUX d2i_X509_CERT_AUX d2i_X509_CINF d2i_X509_CRL d2i_X509_CRL_INFO d2i_X509_CRL_bio d2i_X509_CRL_fp d2i_X509_EXTENSION d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_NAME_ENTRY d2i_X509_PUBKEY d2i_X509_REQ d2i_X509_REQ_INFO d2i_X509_REQ_bio d2i_X509_REQ_fp d2i_X509_REVOKED d2i_X509_SIG d2i_X509_VAL d2i_X509_bio d2i_X509_fp err_free_strings_int i2a_ACCESS_DESCRIPTION i2a_ASN1_ENUMERATED i2a_ASN1_INTEGER i2a_ASN1_OBJECT i2a_ASN1_STRING i2b_PVK_bio i2b_PrivateKey_bio i2b_PublicKey_bio i2d_ACCESS_DESCRIPTION i2d_ADMISSIONS i2d_ADMISSION_SYNTAX i2d_ASIdOrRange i2d_ASIdentifierChoice i2d_ASIdentifiers i2d_ASN1_BIT_STRING i2d_ASN1_BMPSTRING i2d_ASN1_ENUMERATED i2d_ASN1_GENERALIZEDTIME i2d_ASN1_GENERALSTRING i2d_ASN1_IA5STRING i2d_ASN1_INTEGER i2d_ASN1_NULL i2d_ASN1_OBJECT i2d_ASN1_OCTET_STRING i2d_ASN1_PRINTABLE i2d_ASN1_PRINTABLESTRING i2d_ASN1_SEQUENCE_ANY i2d_ASN1_SET_ANY i2d_ASN1_T61STRING i2d_ASN1_TIME i2d_ASN1_TYPE i2d_ASN1_UNIVERSALSTRING i2d_ASN1_UTCTIME i2d_ASN1_UTF8STRING i2d_ASN1_VISIBLESTRING i2d_ASN1_bio_stream i2d_ASRange i2d_AUTHORITY_INFO_ACCESS i2d_AUTHORITY_KEYID i2d_BASIC_CONSTRAINTS i2d_CERTIFICATEPOLICIES i2d_CMS_ContentInfo i2d_CMS_ReceiptRequest i2d_CMS_bio i2d_CMS_bio_stream i2d_CRL_DIST_POINTS i2d_DHparams i2d_DHxparams i2d_DIRECTORYSTRING i2d_DISPLAYTEXT i2d_DIST_POINT i2d_DIST_POINT_NAME i2d_DSAPrivateKey i2d_DSAPrivateKey_bio i2d_DSAPrivateKey_fp i2d_DSAPublicKey i2d_DSA_PUBKEY i2d_DSA_PUBKEY_bio i2d_DSA_PUBKEY_fp i2d_DSA_SIG i2d_DSAparams i2d_ECDSA_SIG i2d_ECPKParameters i2d_ECParameters i2d_ECPrivateKey i2d_ECPrivateKey_bio i2d_ECPrivateKey_fp i2d_EC_PUBKEY i2d_EC_PUBKEY_bio i2d_EC_PUBKEY_fp i2d_EDIPARTYNAME i2d_ESS_CERT_ID i2d_ESS_CERT_ID_V2 i2d_ESS_ISSUER_SERIAL i2d_ESS_SIGNING_CERT i2d_ESS_SIGNING_CERT_V2 i2d_EXTENDED_KEY_USAGE i2d_GENERAL_NAME i2d_GENERAL_NAMES i2d_IPAddressChoice i2d_IPAddressFamily i2d_IPAddressOrRange i2d_IPAddressRange i2d_ISSUING_DIST_POINT i2d_NAMING_AUTHORITY i2d_NETSCAPE_CERT_SEQUENCE i2d_NETSCAPE_SPKAC i2d_NETSCAPE_SPKI i2d_NOTICEREF i2d_OCSP_BASICRESP i2d_OCSP_CERTID i2d_OCSP_CERTSTATUS i2d_OCSP_CRLID i2d_OCSP_ONEREQ i2d_OCSP_REQINFO i2d_OCSP_REQUEST i2d_OCSP_RESPBYTES i2d_OCSP_RESPDATA i2d_OCSP_RESPID i2d_OCSP_RESPONSE i2d_OCSP_REVOKEDINFO i2d_OCSP_SERVICELOC i2d_OCSP_SIGNATURE i2d_OCSP_SINGLERESP i2d_OTHERNAME i2d_PBE2PARAM i2d_PBEPARAM i2d_PBKDF2PARAM i2d_PKCS12 i2d_PKCS12_BAGS i2d_PKCS12_MAC_DATA i2d_PKCS12_SAFEBAG i2d_PKCS12_bio i2d_PKCS12_fp i2d_PKCS7 i2d_PKCS7_DIGEST i2d_PKCS7_ENCRYPT i2d_PKCS7_ENC_CONTENT i2d_PKCS7_ENVELOPE i2d_PKCS7_ISSUER_AND_SERIAL i2d_PKCS7_NDEF i2d_PKCS7_RECIP_INFO i2d_PKCS7_SIGNED i2d_PKCS7_SIGNER_INFO i2d_PKCS7_SIGN_ENVELOPE i2d_PKCS7_bio i2d_PKCS7_bio_stream i2d_PKCS7_fp i2d_PKCS8PrivateKeyInfo_bio i2d_PKCS8PrivateKeyInfo_fp i2d_PKCS8PrivateKey_bio i2d_PKCS8PrivateKey_fp i2d_PKCS8PrivateKey_nid_bio i2d_PKCS8PrivateKey_nid_fp i2d_PKCS8_PRIV_KEY_INFO i2d_PKCS8_PRIV_KEY_INFO_bio i2d_PKCS8_PRIV_KEY_INFO_fp i2d_PKCS8_bio i2d_PKCS8_fp i2d_PKEY_USAGE_PERIOD i2d_POLICYINFO i2d_POLICYQUALINFO i2d_PROFESSION_INFO i2d_PROXY_CERT_INFO_EXTENSION i2d_PROXY_POLICY i2d_PUBKEY i2d_PUBKEY_bio i2d_PUBKEY_fp i2d_PrivateKey i2d_PrivateKey_bio i2d_PrivateKey_fp i2d_PublicKey i2d_RSAPrivateKey i2d_RSAPrivateKey_bio i2d_RSAPrivateKey_fp i2d_RSAPublicKey i2d_RSAPublicKey_bio i2d_RSAPublicKey_fp i2d_RSA_OAEP_PARAMS i2d_RSA_PSS_PARAMS i2d_RSA_PUBKEY i2d_RSA_PUBKEY_bio i2d_RSA_PUBKEY_fp i2d_SCRYPT_PARAMS i2d_SCT_LIST i2d_SXNET i2d_SXNETID i2d_TS_ACCURACY i2d_TS_MSG_IMPRINT i2d_TS_MSG_IMPRINT_bio i2d_TS_MSG_IMPRINT_fp i2d_TS_REQ i2d_TS_REQ_bio i2d_TS_REQ_fp i2d_TS_RESP i2d_TS_RESP_bio i2d_TS_RESP_fp i2d_TS_STATUS_INFO i2d_TS_TST_INFO i2d_TS_TST_INFO_bio i2d_TS_TST_INFO_fp i2d_USERNOTICE i2d_X509 i2d_X509_ALGOR i2d_X509_ALGORS i2d_X509_ATTRIBUTE i2d_X509_AUX i2d_X509_CERT_AUX i2d_X509_CINF i2d_X509_CRL i2d_X509_CRL_INFO i2d_X509_CRL_bio i2d_X509_CRL_fp i2d_X509_EXTENSION i2d_X509_EXTENSIONS i2d_X509_NAME i2d_X509_NAME_ENTRY i2d_X509_PUBKEY i2d_X509_REQ i2d_X509_REQ_INFO i2d_X509_REQ_bio i2d_X509_REQ_fp i2d_X509_REVOKED i2d_X509_SIG i2d_X509_VAL i2d_X509_bio i2d_X509_fp i2d_re_X509_CRL_tbs i2d_re_X509_REQ_tbs i2d_re_X509_tbs i2o_ECPublicKey i2o_SCT i2o_SCT_LIST i2s_ASN1_ENUMERATED i2s_ASN1_ENUMERATED_TABLE i2s_ASN1_IA5STRING i2s_ASN1_INTEGER i2s_ASN1_OCTET_STRING i2t_ASN1_OBJECT i2v_ASN1_BIT_STRING i2v_GENERAL_NAME i2v_GENERAL_NAMES o2i_ECPublicKey o2i_SCT o2i_SCT_LIST s2i_ASN1_IA5STRING s2i_ASN1_INTEGER s2i_ASN1_OCTET_STRING v2i_ASN1_BIT_STRING v2i_GENERAL_NAME v2i_GENERAL_NAMES v2i_GENERAL_NAME_ex

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libssl-1_1.dll

IMPHASH 0fbf72d833f142763a403114ef7eac10
SHA256 797ba3a838a6d0bc7b9b39efec86473ffe4255f782bb54066e81856eb0adf0a9
MD5 723c79630b1971f327fb7bff5ff38eda
SHA1 77844078bfea3b45e7fc4a42e5b7261fc5c6ad3a
SHA512 8329b8755104ad17889e1f4b1ead597a38bec8f07cebc246c5b0e8a0b88e1046d31cd3724e8fb8ed903e52e1e4808324e63ba4d4927a7fae3233ae37da8d31c2
SSDEEP 12288:4b4Y1HbWEsPTvVDAibOrwth/u2aom9qiDrMzNg+6U2lvz9s4:E4Y14JHkbxDrMRg+6U2lvzS4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

363535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libssl-1_1.pdb

libcrypto-1_1

COMP_CTX_new COMP_CTX_free BIO_s_mem EVP_CIPHER_key_length EVP_MD_CTX_ctrl EVP_MD_CTX_set_flags EVP_CIPHER_CTX_new EVP_CIPHER_CTX_reset EVP_md5 EVP_sha1 OPENSSL_sk_num OPENSSL_sk_value OPENSSL_sk_new_reserve OPENSSL_sk_pop_free CRYPTO_memdup CRYPTO_strdup EVP_sha256 EVP_PKEY_security_bits EVP_PKEY_set_type EVP_PKEY_set1_DH EVP_PKEY_new EVP_PKEY_up_ref EVP_PKEY_free EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_free EVP_PKEY_CTX_ctrl EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_derive EVP_PKEY_paramgen_init EVP_PKEY_paramgen EVP_PKEY_keygen_init EVP_PKEY_keygen EC_GROUP_get_curve_name EC_KEY_get0_group X509_NAME_free X509_free ASN1_OCTET_STRING_it INT32_it ZINT32_it UINT32_it ZUINT32_it ZINT64_it ZUINT64_it X509_it CRYPTO_strndup ASN1_item_free ASN1_item_d2i ASN1_item_i2d OPENSSL_DIR_read OPENSSL_DIR_end OPENSSL_sk_shift OPENSSL_sk_pop OPENSSL_sk_set_cmp_func CRYPTO_THREAD_lock_new CRYPTO_THREAD_lock_free CRYPTO_get_ex_new_index CRYPTO_THREAD_run_once BIO_s_file EVP_PKEY_id OPENSSL_LH_new OPENSSL_LH_free OPENSSL_LH_insert OPENSSL_LH_retrieve X509_STORE_new X509_STORE_free X509_STORE_up_ref X509_STORE_CTX_new X509_STORE_CTX_free X509_STORE_CTX_init X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_CTX_set_ex_data X509_STORE_CTX_get_error X509_STORE_CTX_get0_chain X509_STORE_CTX_get1_chain X509_STORE_CTX_set_flags X509_STORE_CTX_get0_param X509_STORE_CTX_set_default X509_STORE_CTX_set0_dane X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_move_peername X509_verify_cert_error_string X509_NAME_dup i2d_X509_NAME X509_get_subject_name X509_up_ref X509_chain_up_ref X509_cmp X509_NAME_hash X509_verify_cert PEM_read_bio_X509 X509_get_extension_flags OPENSSL_sk_new OPENSSL_sk_insert OPENSSL_sk_delete OPENSSL_sk_dup OPENSSL_sk_sort CRYPTO_mem_ctrl OBJ_nid2sn COMP_get_type COMP_get_name COMP_zlib EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_PKEY_asn1_find_str EVP_PKEY_asn1_get0_info ENGINE_finish CONF_parse_list DH_free OBJ_sn2nid EC_curve_nist2nid EC_KEY_new_by_curve_name EC_KEY_free X509_STORE_load_locations PEM_read_bio_DHparams ERR_func_error_string ERR_load_strings_const OPENSSL_init_crypto OPENSSL_atexit err_free_strings_int OBJ_NAME_add EVP_md5_sha1 EVP_sha224 EVP_sha384 EVP_sha512 EVP_des_cbc EVP_des_ede3_cbc EVP_rc4 EVP_rc4_hmac_md5 EVP_idea_cbc EVP_rc2_cbc EVP_rc2_40_cbc EVP_aes_128_cbc EVP_aes_128_ccm EVP_aes_128_gcm EVP_aes_192_cbc EVP_aes_256_cbc EVP_aes_256_ccm EVP_aes_256_gcm EVP_aes_128_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_256_cbc_hmac_sha256 EVP_aria_128_gcm EVP_aria_256_gcm EVP_camellia_128_cbc EVP_camellia_256_cbc EVP_chacha20_poly1305 EVP_seed_cbc EVP_add_cipher EVP_add_digest CRYPTO_THREAD_read_lock CRYPTO_THREAD_write_lock CRYPTO_THREAD_unlock CRYPTO_new_ex_data CRYPTO_dup_ex_data CRYPTO_free_ex_data CRYPTO_set_ex_data CRYPTO_get_ex_data CRYPTO_realloc CRYPTO_secure_zalloc CRYPTO_secure_free BUF_MEM_free COMP_CTX_get_method BIO_int_ctrl BIO_pop BIO_free_all BIO_s_socket OPENSSL_LH_num_items ERR_peek_error OBJ_bsearch_ EVP_CIPHER_CTX_free X509_STORE_add_lookup OPENSSL_cleanse X509_LOOKUP_file X509_LOOKUP_ctrl X509_STORE_set_default_paths X509_VERIFY_PARAM_new X509_VERIFY_PARAM_free X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_trust X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_depth d2i_PUBKEY X509_EXTENSION_free d2i_X509 X509_get0_pubkey X509_check_private_key X509_get_ext_d2i ASYNC_WAIT_CTX_new ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_start_job ASYNC_get_current_job CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time SCT_LIST_free SCT_set_source SCT_get_validation_status SCT_LIST_validate o2i_SCT_LIST CTLOG_STORE_new CTLOG_STORE_free CTLOG_STORE_load_file CTLOG_STORE_load_default_file X509_get_key_usage RAND_priv_bytes OCSP_response_get1_basic OCSP_resp_count OCSP_resp_get0 OCSP_SINGLERESP_get1_ext_d2i OCSP_BASICRESP_free OCSP_RESPID_free OCSP_RESPONSE_free d2i_OCSP_RESPONSE conf_ssl_get conf_ssl_name_find conf_ssl_get_cmd RSA_free RSA_up_ref RSA_flags d2i_RSAPrivateKey ERR_peek_last_error EVP_PKEY_assign EVP_PKEY_get0_RSA EVP_PKEY_get0_EC_KEY d2i_PrivateKey EVP_PKEY_copy_parameters EVP_PKEY_missing_parameters EVP_PKEY_cmp EC_KEY_can_sign d2i_X509_bio d2i_RSAPrivateKey_bio d2i_PrivateKey_bio X509_get_pubkey PEM_read_bio PEM_read_bio_X509_AUX PEM_read_bio_RSAPrivateKey PEM_read_bio_PrivateKey OPENSSL_LH_delete OPENSSL_LH_doall_arg OPENSSL_LH_get_down_load OPENSSL_LH_set_down_load PEM_ASN1_read_bio PEM_ASN1_write_bio PEM_ASN1_read PEM_ASN1_write ENGINE_get_ssl_client_cert_function ENGINE_init BIO_puts BIO_dump_indent BIO_printf EVP_DigestSignInit EVP_PKEY_new_raw_private_key EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_get1_tls_encodedpoint i2d_X509_EXTENSIONS i2d_OCSP_RESPID EVP_DigestSign d2i_X509_EXTENSIONS d2i_OCSP_RESPID BUF_MEM_new BUF_MEM_grow_clean BN_is_zero BN_num_bits BN_bin2bn BN_bn2bin BN_free RSA_pkey_ctx_ctrl DH_new DH_security_bits DH_check_params DH_set0_pqg DH_get0_key DH_set0_key EVP_Digest EVP_DigestInit EVP_DigestVerify EVP_DigestVerifyInit EVP_PKEY_size EVP_PKEY_get0_DH EVP_PKEY_encrypt_init EVP_PKEY_encrypt ENGINE_load_ssl_client_cert BUF_reverse EVP_DigestVerifyFinal d2i_X509_NAME i2d_X509 X509_NAME_cmp BN_ucmp RSA_size RSA_private_decrypt DH_get0_pqg EVP_EncryptInit_ex EVP_EncryptUpdate EVP_EncryptFinal EVP_PKEY_decrypt_init EVP_PKEY_decrypt HMAC_CTX_new HMAC_CTX_free HMAC_Init_ex HMAC_Update HMAC_Final EVP_PKEY_new_mac_key BN_new BN_set_word BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_8192 OBJ_ln2nid EVP_DecryptInit_ex EVP_DecryptUpdate EVP_DecryptFinal EVP_PKEY_get0 EVP_PKEY_get_default_digest_nid HMAC_size EC_GROUP_method_of EC_METHOD_get_field_type EC_KEY_get_conv_form DH_get_1024_160 DH_get_2048_224 X509_get_signature_info X509_get_signature_nid X509_get_issuer_name X509_chain_check_suiteb ERR_set_mark ERR_pop_to_mark BN_clear_free BN_copy BN_dup SRP_create_verifier_BN SRP_check_known_gN_param SRP_get_default_gN SRP_Calc_server_key SRP_Calc_B SRP_Verify_A_mod_N SRP_Calc_u SRP_Calc_x SRP_Calc_A SRP_Calc_client_key SRP_Verify_B_mod_N CRYPTO_clear_free MD5_Transform MD5_Init SHA512_Transform SHA512_Init SHA384_Init SHA256_Transform SHA256_Init SHA224_Init SHA1_Transform SHA1_Init EVP_DigestFinal EVP_DigestInit_ex EVP_MD_type EVP_CipherFinal_ex EVP_CipherUpdate EVP_CipherInit_ex RAND_bytes EVP_CIPHER_CTX_ctrl EVP_DigestSignFinal EVP_MD_CTX_copy EVP_DigestFinal_ex EVP_DigestUpdate EVP_MD_CTX_copy_ex EVP_MD_CTX_free EVP_MD_CTX_new EVP_Cipher EVP_CIPHER_CTX_block_size EVP_CIPHER_iv_length EVP_CIPHER_block_size COMP_expand_block COMP_compress_block CRYPTO_memcmp EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_cipher EVP_CIPHER_flags EVP_MD_CTX_md EVP_MD_size ERR_add_error_data BIO_snprintf CRYPTO_malloc BUF_MEM_grow OPENSSL_sk_push OPENSSL_sk_find OPENSSL_sk_free OPENSSL_sk_new_null ERR_clear_error BIO_ADDR_clear BIO_ADDR_free BIO_ADDR_new BIO_read BIO_test_flags ERR_put_error BIO_copy_next_retry BIO_f_buffer BIO_s_connect BIO_set_retry_reason BIO_get_retry_reason BIO_set_next BIO_next BIO_find_type BIO_push BIO_callback_ctrl BIO_ctrl BIO_write BIO_up_ref BIO_get_shutdown BIO_set_shutdown BIO_get_init BIO_set_init BIO_get_data BIO_set_data BIO_free BIO_new BIO_method_type BIO_clear_flags BIO_set_flags CRYPTO_free X509_LOOKUP_hash_dir CRYPTO_zalloc

kernel32

CreateFileW FlushFileBuffers HeapSize LoadLibraryW OutputDebugStringW WriteConsoleW SetStdHandle HeapReAlloc HeapAlloc RtlUnwind SetConsoleCtrlHandler LoadLibraryExW FreeLibrary InterlockedExchange GetModuleFileNameW SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW FatalAppExitA LeaveCriticalSection EnterCriticalSection Sleep WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter HeapFree GetModuleFileNameA DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap AreFileApisANSI GetModuleHandleExW ExitProcess MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage CreateSemaphoreW GetProcAddress GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThread InterlockedDecrement InterlockedIncrement DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime GetLastError SystemTimeToFileTime GetSystemTime SetLastError CloseHandle

BIO_f_ssl BIO_new_buffer_ssl_connect BIO_new_ssl BIO_new_ssl_connect BIO_ssl_copy_session_id BIO_ssl_shutdown DTLS_client_method DTLS_get_data_mtu DTLS_method DTLS_server_method DTLS_set_timer_cb DTLSv1_2_client_method DTLSv1_2_method DTLSv1_2_server_method DTLSv1_client_method DTLSv1_listen DTLSv1_method DTLSv1_server_method ERR_load_SSL_strings OPENSSL_cipher_name OPENSSL_init_ssl PEM_read_SSL_SESSION PEM_read_bio_SSL_SESSION PEM_write_SSL_SESSION PEM_write_bio_SSL_SESSION SRP_Calc_A_param SSL_CIPHER_description SSL_CIPHER_find SSL_CIPHER_get_auth_nid SSL_CIPHER_get_bits SSL_CIPHER_get_cipher_nid SSL_CIPHER_get_digest_nid SSL_CIPHER_get_handshake_digest SSL_CIPHER_get_id SSL_CIPHER_get_kx_nid SSL_CIPHER_get_name SSL_CIPHER_get_protocol_id SSL_CIPHER_get_version SSL_CIPHER_is_aead SSL_CIPHER_standard_name SSL_COMP_add_compression_method SSL_COMP_get0_name SSL_COMP_get_compression_methods SSL_COMP_get_id SSL_COMP_get_name SSL_COMP_set0_compression_methods SSL_CONF_CTX_clear_flags SSL_CONF_CTX_finish SSL_CONF_CTX_free SSL_CONF_CTX_new SSL_CONF_CTX_set1_prefix SSL_CONF_CTX_set_flags SSL_CONF_CTX_set_ssl SSL_CONF_CTX_set_ssl_ctx SSL_CONF_cmd SSL_CONF_cmd_argv SSL_CONF_cmd_value_type SSL_CTX_SRP_CTX_free SSL_CTX_SRP_CTX_init SSL_CTX_add1_to_CA_list SSL_CTX_add_client_CA SSL_CTX_add_client_custom_ext SSL_CTX_add_custom_ext SSL_CTX_add_server_custom_ext SSL_CTX_add_session SSL_CTX_callback_ctrl SSL_CTX_check_private_key SSL_CTX_clear_options SSL_CTX_config SSL_CTX_ct_is_enabled SSL_CTX_ctrl SSL_CTX_dane_clear_flags SSL_CTX_dane_enable SSL_CTX_dane_mtype_set SSL_CTX_dane_set_flags SSL_CTX_enable_ct SSL_CTX_flush_sessions SSL_CTX_free SSL_CTX_get0_CA_list SSL_CTX_get0_certificate SSL_CTX_get0_ctlog_store SSL_CTX_get0_param SSL_CTX_get0_privatekey SSL_CTX_get0_security_ex_data SSL_CTX_get_cert_store SSL_CTX_get_ciphers SSL_CTX_get_client_CA_list SSL_CTX_get_client_cert_cb SSL_CTX_get_default_passwd_cb SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_ex_data SSL_CTX_get_info_callback SSL_CTX_get_keylog_callback SSL_CTX_get_max_early_data SSL_CTX_get_num_tickets SSL_CTX_get_options SSL_CTX_get_quiet_shutdown SSL_CTX_get_record_padding_callback_arg SSL_CTX_get_recv_max_early_data SSL_CTX_get_security_callback SSL_CTX_get_security_level SSL_CTX_get_ssl_method SSL_CTX_get_timeout SSL_CTX_get_verify_callback SSL_CTX_get_verify_depth SSL_CTX_get_verify_mode SSL_CTX_has_client_custom_ext SSL_CTX_load_verify_locations SSL_CTX_new SSL_CTX_remove_session SSL_CTX_sess_get_get_cb SSL_CTX_sess_get_new_cb SSL_CTX_sess_get_remove_cb SSL_CTX_sess_set_get_cb SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb SSL_CTX_sessions SSL_CTX_set0_CA_list SSL_CTX_set0_ctlog_store SSL_CTX_set0_security_ex_data SSL_CTX_set1_cert_store SSL_CTX_set1_param SSL_CTX_set_allow_early_data_cb SSL_CTX_set_alpn_protos SSL_CTX_set_alpn_select_cb SSL_CTX_set_block_padding SSL_CTX_set_cert_cb SSL_CTX_set_cert_store SSL_CTX_set_cert_verify_callback SSL_CTX_set_cipher_list SSL_CTX_set_ciphersuites SSL_CTX_set_client_CA_list SSL_CTX_set_client_cert_cb SSL_CTX_set_client_cert_engine SSL_CTX_set_client_hello_cb SSL_CTX_set_cookie_generate_cb SSL_CTX_set_cookie_verify_cb SSL_CTX_set_ct_validation_callback SSL_CTX_set_ctlog_list_file SSL_CTX_set_default_ctlog_list_file SSL_CTX_set_default_passwd_cb SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_default_read_buffer_len SSL_CTX_set_default_verify_dir SSL_CTX_set_default_verify_file SSL_CTX_set_default_verify_paths SSL_CTX_set_ex_data SSL_CTX_set_generate_session_id SSL_CTX_set_info_callback SSL_CTX_set_keylog_callback SSL_CTX_set_max_early_data SSL_CTX_set_msg_callback SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_not_resumable_session_callback SSL_CTX_set_num_tickets SSL_CTX_set_options SSL_CTX_set_post_handshake_auth SSL_CTX_set_psk_client_callback SSL_CTX_set_psk_find_session_callback SSL_CTX_set_psk_server_callback SSL_CTX_set_psk_use_session_callback SSL_CTX_set_purpose SSL_CTX_set_quiet_shutdown SSL_CTX_set_record_padding_callback SSL_CTX_set_record_padding_callback_arg SSL_CTX_set_recv_max_early_data SSL_CTX_set_security_callback SSL_CTX_set_security_level SSL_CTX_set_session_id_context SSL_CTX_set_session_ticket_cb SSL_CTX_set_srp_cb_arg SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_password SSL_CTX_set_srp_strength SSL_CTX_set_srp_username SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_ssl_version SSL_CTX_set_stateless_cookie_generate_cb SSL_CTX_set_stateless_cookie_verify_cb SSL_CTX_set_timeout SSL_CTX_set_tlsext_max_fragment_length SSL_CTX_set_tlsext_use_srtp SSL_CTX_set_tmp_dh_callback SSL_CTX_set_trust SSL_CTX_set_verify SSL_CTX_set_verify_depth SSL_CTX_up_ref SSL_CTX_use_PrivateKey SSL_CTX_use_PrivateKey_ASN1 SSL_CTX_use_PrivateKey_file SSL_CTX_use_RSAPrivateKey SSL_CTX_use_RSAPrivateKey_ASN1 SSL_CTX_use_RSAPrivateKey_file SSL_CTX_use_cert_and_key SSL_CTX_use_certificate SSL_CTX_use_certificate_ASN1 SSL_CTX_use_certificate_chain_file SSL_CTX_use_certificate_file SSL_CTX_use_psk_identity_hint SSL_CTX_use_serverinfo SSL_CTX_use_serverinfo_ex SSL_CTX_use_serverinfo_file SSL_SESSION_dup SSL_SESSION_free SSL_SESSION_get0_alpn_selected SSL_SESSION_get0_cipher SSL_SESSION_get0_hostname SSL_SESSION_get0_id_context SSL_SESSION_get0_peer SSL_SESSION_get0_ticket SSL_SESSION_get0_ticket_appdata SSL_SESSION_get_compress_id SSL_SESSION_get_ex_data SSL_SESSION_get_id SSL_SESSION_get_master_key SSL_SESSION_get_max_early_data SSL_SESSION_get_max_fragment_length SSL_SESSION_get_protocol_version SSL_SESSION_get_ticket_lifetime_hint SSL_SESSION_get_time SSL_SESSION_get_timeout SSL_SESSION_has_ticket SSL_SESSION_is_resumable SSL_SESSION_new SSL_SESSION_print SSL_SESSION_print_fp SSL_SESSION_print_keylog SSL_SESSION_set1_alpn_selected SSL_SESSION_set1_hostname SSL_SESSION_set1_id SSL_SESSION_set1_id_context SSL_SESSION_set1_master_key SSL_SESSION_set1_ticket_appdata SSL_SESSION_set_cipher SSL_SESSION_set_ex_data SSL_SESSION_set_max_early_data SSL_SESSION_set_protocol_version SSL_SESSION_set_time SSL_SESSION_set_timeout SSL_SESSION_up_ref SSL_SRP_CTX_free SSL_SRP_CTX_init SSL_accept SSL_add1_host SSL_add1_to_CA_list SSL_add_client_CA SSL_add_dir_cert_subjects_to_stack SSL_add_file_cert_subjects_to_stack SSL_add_ssl_module SSL_alert_desc_string SSL_alert_desc_string_long SSL_alert_type_string SSL_alert_type_string_long SSL_alloc_buffers SSL_bytes_to_cipher_list SSL_callback_ctrl SSL_certs_clear SSL_check_chain SSL_check_private_key SSL_clear SSL_clear_options SSL_client_hello_get0_ciphers SSL_client_hello_get0_compression_methods SSL_client_hello_get0_ext SSL_client_hello_get0_legacy_version SSL_client_hello_get0_random SSL_client_hello_get0_session_id SSL_client_hello_get1_extensions_present SSL_client_hello_isv2 SSL_client_version SSL_config SSL_connect SSL_copy_session_id SSL_ct_is_enabled SSL_ctrl SSL_dane_clear_flags SSL_dane_enable SSL_dane_set_flags SSL_dane_tlsa_add SSL_do_handshake SSL_dup SSL_dup_CA_list SSL_enable_ct SSL_export_keying_material SSL_export_keying_material_early SSL_extension_supported SSL_free SSL_free_buffers SSL_get0_CA_list SSL_get0_alpn_selected SSL_get0_dane SSL_get0_dane_authority SSL_get0_dane_tlsa SSL_get0_next_proto_negotiated SSL_get0_param SSL_get0_peer_CA_list SSL_get0_peer_scts SSL_get0_peername SSL_get0_security_ex_data SSL_get0_verified_chain SSL_get1_session SSL_get1_supported_ciphers SSL_get_SSL_CTX SSL_get_all_async_fds SSL_get_certificate SSL_get_changed_async_fds SSL_get_cipher_list SSL_get_ciphers SSL_get_client_CA_list SSL_get_client_ciphers SSL_get_client_random SSL_get_current_cipher SSL_get_current_compression SSL_get_current_expansion SSL_get_default_passwd_cb SSL_get_default_passwd_cb_userdata SSL_get_default_timeout SSL_get_early_data_status SSL_get_error SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_fd SSL_get_finished SSL_get_info_callback SSL_get_key_update_type SSL_get_max_early_data SSL_get_num_tickets SSL_get_options SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_get_peer_finished SSL_get_peer_signature_type_nid SSL_get_pending_cipher SSL_get_privatekey SSL_get_psk_identity SSL_get_psk_identity_hint SSL_get_quiet_shutdown SSL_get_rbio SSL_get_read_ahead SSL_get_record_padding_callback_arg SSL_get_recv_max_early_data SSL_get_rfd SSL_get_security_callback SSL_get_security_level SSL_get_selected_srtp_profile SSL_get_server_random SSL_get_servername SSL_get_servername_type SSL_get_session SSL_get_shared_ciphers SSL_get_shared_sigalgs SSL_get_shutdown SSL_get_sigalgs SSL_get_signature_type_nid SSL_get_srp_N SSL_get_srp_g SSL_get_srp_userinfo SSL_get_srp_username SSL_get_srtp_profiles SSL_get_ssl_method SSL_get_state SSL_get_verify_callback SSL_get_verify_depth SSL_get_verify_mode SSL_get_verify_result SSL_get_version SSL_get_wbio SSL_get_wfd SSL_has_matching_session_id SSL_has_pending SSL_in_before SSL_in_init SSL_is_dtls SSL_is_init_finished SSL_is_server SSL_key_update SSL_load_client_CA_file SSL_new SSL_peek SSL_peek_ex SSL_pending SSL_read SSL_read_early_data SSL_read_ex SSL_renegotiate SSL_renegotiate_abbreviated SSL_renegotiate_pending SSL_rstate_string SSL_rstate_string_long SSL_select_next_proto SSL_session_reused SSL_set0_CA_list SSL_set0_rbio SSL_set0_security_ex_data SSL_set0_wbio SSL_set1_host SSL_set1_param SSL_set_SSL_CTX SSL_set_accept_state SSL_set_allow_early_data_cb SSL_set_alpn_protos SSL_set_bio SSL_set_block_padding SSL_set_cert_cb SSL_set_cipher_list SSL_set_ciphersuites SSL_set_client_CA_list SSL_set_connect_state SSL_set_ct_validation_callback SSL_set_debug SSL_set_default_passwd_cb SSL_set_default_passwd_cb_userdata SSL_set_default_read_buffer_len SSL_set_ex_data SSL_set_fd SSL_set_generate_session_id SSL_set_hostflags SSL_set_info_callback SSL_set_max_early_data SSL_set_msg_callback SSL_set_not_resumable_session_callback SSL_set_num_tickets SSL_set_options SSL_set_post_handshake_auth SSL_set_psk_client_callback SSL_set_psk_find_session_callback SSL_set_psk_server_callback SSL_set_psk_use_session_callback SSL_set_purpose SSL_set_quiet_shutdown SSL_set_read_ahead SSL_set_record_padding_callback SSL_set_record_padding_callback_arg SSL_set_recv_max_early_data SSL_set_rfd SSL_set_security_callback SSL_set_security_level SSL_set_session SSL_set_session_id_context SSL_set_session_secret_cb SSL_set_session_ticket_ext SSL_set_session_ticket_ext_cb SSL_set_shutdown SSL_set_srp_server_param SSL_set_srp_server_param_pw SSL_set_ssl_method SSL_set_tlsext_max_fragment_length SSL_set_tlsext_use_srtp SSL_set_tmp_dh_callback SSL_set_trust SSL_set_verify SSL_set_verify_depth SSL_set_verify_result SSL_set_wfd SSL_shutdown SSL_srp_server_param_with_username SSL_state_string SSL_state_string_long SSL_stateless SSL_up_ref SSL_use_PrivateKey SSL_use_PrivateKey_ASN1 SSL_use_PrivateKey_file SSL_use_RSAPrivateKey SSL_use_RSAPrivateKey_ASN1 SSL_use_RSAPrivateKey_file SSL_use_cert_and_key SSL_use_certificate SSL_use_certificate_ASN1 SSL_use_certificate_chain_file SSL_use_certificate_file SSL_use_psk_identity_hint SSL_verify_client_post_handshake SSL_version SSL_waiting_for_async SSL_want SSL_write SSL_write_early_data SSL_write_ex TLS_client_method TLS_method TLS_server_method TLSv1_1_client_method TLSv1_1_method TLSv1_1_server_method TLSv1_2_client_method TLSv1_2_method TLSv1_2_server_method TLSv1_client_method TLSv1_method TLSv1_server_method d2i_SSL_SESSION i2d_SSL_SESSION

Name

.text

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

locale/da_DK.mo

SHA256 198a97a4a030673daf7111b28ccc5ab6ecfd4983f83d27d06ccad17ed4c19af8
MD5 f08facd8aa94aac6edcb50e44413539b
SHA1 64c4bdb67346c419a64fd6710abb494bb4b8053a
SHA512 f2af595d457a807a28ed052d68fc8ffd63e642ba3b604370ab499265512906cd40c1a33ebd1de0146e3a79e2d730035e6fa7b409b2147c28b22225ef92966da1
SSDEEP 6144:Uywpz+ROZIrUoSv4rCGMDymxCgoCzOxy02M5v8U:C1vAVcMCGCXzOxy0h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/de_DE.mo

SHA256 7aa98eb6c2b2bde4267e4fb0a2c2406960b4683a4c30b7c6d1ce0ab2c3b1888d
MD5 67aed97c8b5894e2ec4af71d1e9c08a8
SHA1 97e768ef85650e062e08b39510a997f45ab1ddf2
SHA512 48b9fadeaff61c6f312646fcb32f40410dd74c1762d464e1ab2dcc00a32b5c5dbc44f98fb2b448393350793a2c9b2ae0085373692465f2126ddaf7b99310b9fc
SSDEEP 6144:UywCOcIrUoSv4rCGMDymxCAKDdVPO9cIY1l:CjVcMCGCVeE9cD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/es_ES.mo

SHA256 cbfaf51eb5c21adb88738a490fe9dad1bd102770278739b617f1f4e8e4371326
MD5 614e56bdf4a411c53a18f49f79785910
SHA1 e7f313e80c1be5e11a6102bf4299813a1aa341e5
SHA512 8b9019ae5e05dcde25263bae26254cf2260e3a1b4c19d7ff0ab327533d11466daa3bdf9bd51d79bef36d492fa651ccf88a541e23de8bf3a9b3b6a35e9cf6256b
SSDEEP 3072:UGNLwQC9plU6cdYvs+nOiQvUoSvAlrgceGcI8MwymxCIeGqC1+4hCo8S78xLihS:UywpZIrUoSv4rCGMDymxCLGD+OYxLT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/fr_FR.mo

SHA256 fcd58257ce900f70ff980c09d41dd9dcface0239b68b9f7fed7200b79ca66289
MD5 988ab371ee60a6e7c0eec6d6f6b383a7
SHA1 e0349ddd4680d57888b8b9b12d3ac77dfe3bf4a5
SHA512 ae1bc32b5db2af992766ee3c55da13ed33994b2ad6cd2a4369796f6f2f256f5c0709c07cd1a737b463b2c492d1c3c3d4bffeba2ad5c05bb111fa34c7eaf53553
SSDEEP 6144:UywKdvIrUoSv4rCGMDymxCiP3SvfNIGACzxRoGYWFqG0dMRxhQGAAy:CamVcMCGCgvfNIGACzxRpq8RxhQH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/it_IT.mo

SHA256 646822136c4619f4d67992f6a10ccb85ffc0982520d2529a80eec3d9cae2cbb8
MD5 06553c913675179ba6e24c252f86e249
SHA1 ed85ba9730096240c933684f8b72efb85830414e
SHA512 9ad9fec94c904fee68573df67c23faba766358c6bc9beedf2d5c14783b60a7254d867361eeaa2b0008ff89a257771382fd382854cf6d6d599ff1c07da383c36d
SSDEEP 6144:Uywd+f+nIrUoSv4rCGMDymxCjSRCSd3vEQAfm1dOIFjjmFQ2mYNo+sQnFQK0OCCM:CsVcMCGC7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/nl_NL.mo

SHA256 f84f5e720e41a352913d2b955565ab98144b325c6db33f3eccefd1043a451c32
MD5 dcdd88adba09e2971c16ee711933499e
SHA1 9577f8bc7177dd1021dc9c368cdb7ff4a0fb8713
SHA512 be8856de2d9dc2987d7b67ea7198df41997acad2af4d163657ebc2752408f19963c90a9517078fc4ccd10216f0d1d37c6c64e309d4c32e6036b59db33f4a38d6
SSDEEP 6144:UywdUuQ3IYIrUoSv4rCGMDymxC+inJCE3IBHW:CdHjVcMCGCT3W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/nn_NO.mo

SHA256 f1c261644e3fca3caff1df5cca96bb28d1802adc9324b33756f3cfa14d875f8e
MD5 090f679197c4e23842d65bce9f1d4439
SHA1 8fcff56fabd2204aef744b1299bc38c472ebfdc3
SHA512 89cee1be16bddd60693926b7f4dcb06fbbc0b4e4899d5221d062c05d99a916b67e8e2f837d11e88bb030e90b732d75be5a747daf58b06f23a5e2d46eb52742dc
SSDEEP 6144:UywElhiZIrUoSv4rCGMDymxCdmGWbqsR7IbUknwrl9AL:Cg/VcMCGCMs6vnL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/pl_PL.mo

SHA256 ffd3da0af26e4709d06512fad9e30c328ec8c006406f4282a9b9aa918838ed74
MD5 d535387b4fde31de55933b124aeecef4
SHA1 fdc82ecffc26436ceb5266e7b6d3744cf6f9ed8c
SHA512 f1aa1dcfcc100ef45f87dcd00a220e860f79678112d8be2d2f3b2ff6da8ed420b8fd616bdabda7d12bb636715725e2761412c6852c9822bd772060410e6eab17
SSDEEP 6144:UywzSVgIrUoSv4rCGMDymxCJufXKcXK0fzbDkysPXafn4KjRL:CGVVcMCGC0c60bkysfaf4YF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/pt_PT.mo

SHA256 6daaa68342a21b72991ab101466aff5aba5dee6e9064515f1086926992a61dc3
MD5 156476992f597fb7e9aa479c1e8df9d9
SHA1 8fbed01207ef7048ca03f67224004903f53e8879
SHA512 7d449c2054c1234fcc34ce885c850778e630f68e0a57057e7e3601ec851f6210131cb9cfde1ec07b1fb6e69a73047eb17cde095d606afb13d3ff33dcc6f0a567
SSDEEP 3072:UGNLwQC4dJ2cdYvs+nOiQvUoSvAlrgceGcI8MwymxC2l0JLSssX//BW9afQEiQfe:UywadEIrUoSv4rCGMDymxCvyM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/sv_SE.mo

SHA256 83672b3cb518c4ebb6d1b11c31aa6c54ebdb599c6806b8a8ef1b19f2ecbc5a08
MD5 df7f4d51f005ec1b183c1e002cf0d9ff
SHA1 df7652f6c9ebbc6835cb8af5b7f016ee53144060
SHA512 6fe660cd4a8e6802eadcbf93f55a5323a578e956b6545918f38c97d9e53e3bde8ea079be9866969f4d1a861c8fd59de3c0dd2132963c8553f9f7bcfeff283b04
SSDEEP 6144:UywUfdqIrUoSv4rCGMDymxC4y3SwaSbBpBEjtxOrQy6LrvJ3f3EX:CU/VcMCGC5JwaSbJIu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/tr_TR.mo

SHA256 5830a5723e9a5fdae55981cc700373120eb1d1d75b1dadde95b549654647a531
MD5 b2c3276d6597d682d79c9223780c0390
SHA1 bd14ebea1fb15bc60c117020e5dc46bbc866903f
SHA512 f605e5d00f19c2a8ecd8f9c7c070ab08e938caf785fe2c9cc218e301575a4598ac1fc94bcdfcaee54d5e36781274feaa828aeeaf3e9ea7ae41f0830fa4754eb3
SSDEEP 3072:UGNLwQCKAdLcdYvs+nOiQvUoSvAlrgceGcI8MwymxCTRqYMAwAJyJcy3TlgD0grv:UywXLIrUoSv4rCGMDymxCaA110gVzzJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

mscordaccore.dll

IMPHASH b48f4be60ce658f8283045be599a540f
SHA256 5863e623795cf411c543f1325ca35a8dd46b6d8ec4abfb58f322b03d9d3ac38d
MD5 08be23bed07db857163f991020ce0a8c
SHA1 c30c7fefdb3713a39a907f50597420646dd0124e
SHA512 639ebb82515076250b9954f95ae7d9e01a2b6af215a7c2c37db3fd69f9b5323461a014a4760f9b7dd69f1daaa8cc1d1bd99f8eed1d5f6ca86ab26f7a846ce59b
SSDEEP 24576:ZsNvkhyIJUu6l//8uLFu4VCXC+PG9/jrxiXRNN/5k6B4Y:y2hyIqT//8uLFuACSZ/jALC6B4Y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e9:eb:de:1e:6e:fb:af:47:d7:eb:e4:bc:79:f5:f8:9e:77:bb:ba:1a:a3:47:d7:c1:8f:34:0e:1e:f4:80:52:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

636656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb

kernel32

GetCurrentProcess SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile FlushFileBuffers WriteFile ReadFile GetProcessHeap HeapAlloc HeapFree GetACP LCMapStringEx IsDBCSLeadByte FormatMessageW LocalFree TlsGetValue TlsAlloc TlsFree RaiseException TlsSetValue CreateEventW SetEvent ResetEvent WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate SetLastError GetCurrentThreadId GetSystemTimeAsFileTime DebugBreak GetProcessAffinityMask SwitchToThread GetEnvironmentVariableW GetFullPathNameW ReadProcessMemory LoadLibraryExW CreateFileW GetModuleFileNameW TerminateProcess OutputDebugStringW IsDebuggerPresent RaiseFailFastException CloseHandle FreeLibrary GetSystemInfo GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection GetEnvironmentVariableA WideCharToMultiByte GetLastError MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoTaskMemFree CoCreateGuid IIDFromString

oleaut32

SetErrorInfo CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscat_s strcmp strcpy_s strlen strncat_s wcsncat_s wcsncmp _wcslwr_s wcscpy_s strncmp strncpy_s strnlen

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo abort _cexit _errno _execute_onexit_table _initterm _initterm_e terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_flushall __stdio_common_vsprintf_s __stdio_common_vsnwprintf_s _putws __stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-convert-l1-1-0

wcstoul

mscordaccore_x86_x86_4.700.21.26205.dll

IMPHASH b48f4be60ce658f8283045be599a540f
SHA256 5863e623795cf411c543f1325ca35a8dd46b6d8ec4abfb58f322b03d9d3ac38d
MD5 08be23bed07db857163f991020ce0a8c
SHA1 c30c7fefdb3713a39a907f50597420646dd0124e
SHA512 639ebb82515076250b9954f95ae7d9e01a2b6af215a7c2c37db3fd69f9b5323461a014a4760f9b7dd69f1daaa8cc1d1bd99f8eed1d5f6ca86ab26f7a846ce59b
SSDEEP 24576:ZsNvkhyIJUu6l//8uLFu4VCXC+PG9/jrxiXRNN/5k6B4Y:y2hyIqT//8uLFuACSZ/jALC6B4Y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e9:eb:de:1e:6e:fb:af:47:d7:eb:e4:bc:79:f5:f8:9e:77:bb:ba:1a:a3:47:d7:c1:8f:34:0e:1e:f4:80:52:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

636656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb

kernel32

GetCurrentProcess SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile FlushFileBuffers WriteFile ReadFile GetProcessHeap HeapAlloc HeapFree GetACP LCMapStringEx IsDBCSLeadByte FormatMessageW LocalFree TlsGetValue TlsAlloc TlsFree RaiseException TlsSetValue CreateEventW SetEvent ResetEvent WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate SetLastError GetCurrentThreadId GetSystemTimeAsFileTime DebugBreak GetProcessAffinityMask SwitchToThread GetEnvironmentVariableW GetFullPathNameW ReadProcessMemory LoadLibraryExW CreateFileW GetModuleFileNameW TerminateProcess OutputDebugStringW IsDebuggerPresent RaiseFailFastException CloseHandle FreeLibrary GetSystemInfo GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection GetEnvironmentVariableA WideCharToMultiByte GetLastError MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoTaskMemFree CoCreateGuid IIDFromString

oleaut32

SetErrorInfo CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscat_s strcmp strcpy_s strlen strncat_s wcsncat_s wcsncmp _wcslwr_s wcscpy_s strncmp strncpy_s strnlen

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo abort _cexit _errno _execute_onexit_table _initterm _initterm_e terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_flushall __stdio_common_vsprintf_s __stdio_common_vsnwprintf_s _putws __stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-convert-l1-1-0

wcstoul

mscordbi.dll

IMPHASH 406ce9b644c8bf4e31063e1f8559d643
SHA256 91b0034f0ebfb3aded2217052304daa88cfebe7f3e5456bc5cfd0aba09e92820
MD5 6e9f536c76179da199105cb7356a72b7
SHA1 f55a15a7969cd55a791f9b6c2a7e6e3dc9595b88
SHA512 a4b2e732fa7869158bea52eab6f1c678eac50c5821fd3548c3f51e9994794c7ca062c7a01c94292519541f97d64d4a4a866fd0495072999f47a6ad6d8a195202
SSDEEP 12288:edQt1RMARaEd4DAMz/9RhpL0E3YEE4cD9Gc1MS4ZCj1t0JT10wOgRJgP6dEAK1AV:edQzY7YqmP91t0t1y8aavKDQIVI9p3D
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8a:8e:3a:a7:24:23:88:0b:06:7a:d1:9e:4d:7b:e2:e2:b2:55:78:48:27:e0:5f:7e:97:b0:be:01:8c:ce:ec:66

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

671440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordbi\Release\mscordbi.pdb

kernel32

OpenThread SuspendThread ResumeThread DuplicateHandle CreateThread TerminateProcess GetThreadContext SetThreadContext ContinueDebugEvent FreeLibrary VirtualQueryEx GetModuleHandleW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile Sleep DebugActiveProcess DebugActiveProcessStop WaitForDebugEvent OpenProcess GetCurrentProcessId IsWow64Process ReadProcessMemory WriteProcessMemory SetLastError GetSystemTimeAsFileTime GetProcessHeap HeapAlloc HeapFree RaiseException GetSystemInfo IsDebuggerPresent DebugBreak LoadLibraryExW CreateFileW GetFileAttributesExW GetModuleFileNameW FlushInstructionCache GetEnvironmentVariableW GetFullPathNameW MultiByteToWideChar SwitchToThread GetCurrentThread GetACP LCMapStringEx IsDBCSLeadByte FormatMessageW LocalFree CreateProcessW TlsGetValue TlsAlloc TlsFree TlsSetValue WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate WriteFile SetFilePointer FlushFileBuffers ReadFile InitializeCriticalSectionAndSpinCount GetCurrentThreadId ResetEvent SetEvent CreateEventW WaitForMultipleObjectsEx GetProcAddress WaitForSingleObject LoadLibraryW WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection CloseHandle GetCurrentProcess GetLastError EnterCriticalSection LeaveCriticalSection EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation SetThreadToken RevertToSelf OpenThreadToken RegQueryValueExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

ole32

IIDFromString CoTaskMemAlloc CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoTaskMemFree CoCreateGuid

oleaut32

SetErrorInfo VariantInit CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

strncpy_s wcsncmp strncmp wcsncat_s wcscpy_s _wcsicmp wcscat_s wcsncpy_s strcpy_s wcsnlen

api-ms-win-crt-runtime-l1-1-0

_cexit _invalid_parameter_noinfo _errno abort _initterm _execute_onexit_table _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll terminate _initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-math-l1-1-0

_except1

mscorlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 93fcf70d37671300b66fb23c4c9d944ddf06698db9f9291b438d2da847504fab
MD5 263557addb8e7f78d151ae814520adb7
SHA1 1e650fec585180f74a6eded2bfe4e75e1d1b7dc6
SHA512 5f485fd59e235908b0a69ce026affa7ae2d7957fc5560cb3eaa7e91f8d215783933f4a476730ae97d6b826e2dc406b9d38c8d40af1707b835b782cddff1dea19
SSDEEP 384:4niCq6HTn8KR6WdUtox5q64O3HZhB52YtUBVT9yaDbcZN8dV0IaohKuirRkvx9AJ:In9RzF5J4yklDbcZV/C6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mscorrc.debug.dll

SHA256 78a99ac5fb00d75f8061fd0df742a75e26a5c5a5f4b35d83736bb1d0a2d11038
MD5 9e085c9b6487f2d7b19ad4293b6c85d4
SHA1 d533fd4f9f5bf8dca476c3005151769552951fd8
SHA512 c847421a097a73041b2cd74caf462c071971bc477ffd43edefc98c597cb3371ae33e2885395b6b706d75d9c7fc5277273ce710f26dfef9d9ba95810922db7f43
SSDEEP 1536:pJqRwZzb8IVAkR1RhQi/s1PzHvh7xYSmUlMbcCV9jfnw5RVvZ48MSZctpoEXtVTb:pJqRwZzgASHlMbrhnYDAS4SG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

96:d2:2c:71:ed:1c:98:49:1e:66:ac:5a:f1:86:ef:4b:89:13:7c:47:a8:4c:52:c1:3f:a8:a6:c9:de:6c:58:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\full\Release\mscorrc.debug.pdb

mscorrc.dll

SHA256 727a1116cb9551a1002c4dfa0695de791ac4261b75caa39a3b13fd417d1d537f
MD5 bc81568e8d7ed73e1890029909930431
SHA1 a8d2ee2d03670c21e2c9a03f57e2be6977869558
SHA512 32ca46b4b3c7a922d2375155d1981e7518a2cd0ed0f28a300357cf68ea1f52cacfbf5040d9f5a3f0f14c65e71d04e36d0e01a0a5117bfbc498888b09d8ad4294
SSDEEP 192:eWPLSdiWYSQuz3WULwu0Sc2HnhWgN7aQWmFs4ptDqnajKsWuZs7S:eWPGdiWfQoD/HRN7RFs4lGsWYsu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fa:1f:07:af:cd:f0:f0:ed:1f:0b:9c:9a:71:0b:b5:29:6a:e4:04:7e:6a:38:76:aa:87:11:4b:40:f3:44:c8:f9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\small\Release\mscorrc.pdb

netstandard.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c91e544b6c98089620fbe0e98bd3288cd06ddd66e0510298f62db12f14ac4b3
MD5 43b0ff3ea5fea2eab8d6458683f4a30c
SHA1 2ae87236958078dc88c4cefd4780b13cd2efa540
SHA512 bb7e013faf57969396d623a42c25308d01c02e266a737c1e3b8594ba8074dad37266eb4a15d883e41f51629a2cc0a99ca8f83ab478f2caeaddf05a5b0c75b4ad
SSDEEP 1536:xt/o2bVXhTETV9yN9eQe1YYu5C4bObKZ8N0s51ukFOW:z5Pb7YL4bOqy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

79406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nfapi.dll

IMPHASH 144166113ab4a5e253b0d586d0c21c38
SHA256 15ffff704ac5fbf71b704210cfed724e67274f83342d6492c3cc25ea889143f8
MD5 a97bf9885ae2baf03970ea7bd98e8e29
SHA1 bd3aab1ab192968a5793ef4be1d6ac18f0a015f5
SHA512 371810b7a393c6d44f706c7fc7c50b11364421e552015fb70517bb96fd991750401d3ac1238394651f9556f8329939984e4bfa50ed9fa5fb418fbfc37da8a651
SSDEEP 3072:rKpHwC6H+AYYYxYYYYYrs/NAWOZFvyfaP710WkYsf+6pu6v3tgHf+dNUxJcGtHFE:rKpHMg61ZFvyfKLkzfrnvGHfDcGtr6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

71:70:ec:22:a8:6f:75:dc:10:5e:c2:8e:0e:83:da:ae:8a:ad:9c:90:9a:0c:2b:10:91:b1:bc:78:48:55:39:81

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 9, 2021

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

92182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\nfapi\build\release_c_api\win32\nfapi.pdb

kernel32

InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObject CreateEventA GetCurrentProcessId OpenProcess CancelIo GetTickCount GetModuleHandleA GetProcAddress WaitForMultipleObjects CreateFileA GetVersionExA DeviceIoControl GetOverlappedResult SetLastError GetLastError CloseHandle WriteFile ReadFile QueryDosDeviceW GetLogicalDriveStringsW GetDriveTypeW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemInfo InitializeCriticalSection FlushFileBuffers WriteConsoleW SetStdHandle HeapFree HeapAlloc EncodePointer DecodePointer CreateThread GetCurrentThreadId ExitThread LoadLibraryExW RaiseException RtlUnwind GetCommandLineA GetProcessHeap InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapSize Sleep IsDebuggerPresent InterlockedIncrement GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW GetFileType GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte FatalAppExitA InterlockedExchange FreeLibrary SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo OutputDebugStringW LoadLibraryW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx GetStringTypeW CreateFileW

advapi32

QueryServiceStatus OpenServiceA OpenSCManagerA DeleteService CreateServiceW CloseServiceHandle RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceA

psapi

GetModuleFileNameExA GetModuleFileNameExW

Name

.text

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

nfregdrv.exe

IMPHASH 40b9d8afc649d5414a04999cb3a4d2f0
SHA256 aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812
MD5 01b5780505301ada6dc102fb77b2298c
SHA1 328c3931a54af2d7adb88ba4c4c18ce1af8d5a72
SHA512 bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947
SSDEEP 768:2/1x+sxHjR9Q9V0nczMWkL/zDJ6kqsEtm:YjR8VfRkL0Jtm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

h:\projects\netfilter3\bin\Release_c_api\Win32\nfregdrv.pdb

ovpn/libcrypto-1_1.dll

IMPHASH 30831802350709b833fba83ada7b124e
SHA256 d8fbdfaaebfc1f5c5c8fbaacd247c86bf1411089acb02f3d0e84b213350ff2e4
MD5 034d15c7f0c26c2b7723af63060e0b67
SHA1 e4abd51721a655bfcef283afd2f2a039ad5255ee
SHA512 60a1c1a74180d0e4ec7484f3722c15a23d01763be0bedaa75ea37549df8c14e6ea7568538e59a4a3300c6865d5d038eb12ecc3f0232b02ab418ffee6f6c03094
SSDEEP 49152:/F6M1lo16J3+V/fY24JAMHfA3qNko15TpKD3OMER7/i1Jtum1CPwDv3uFtPeNfig:96M1z+VI24JAMHI3qNko1pYj+Ru1JtV3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Digest

ca:02:c0:58:c8:fa:ce:9d:df:c9:ab:86:db:d1:cd:52:75:43:36:95:5b:43:ca:f1:d1:f2:b4:f9:ef:7c:06:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 26, 2018

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

03:e4:9b:29:ae:75:df:4c:50:dc:16:62:67:07:76:b9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 25, 2016 - Oct 9, 2019

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource RegisterEventSourceA RegisterEventSourceW ReportEventA ReportEventW

kernel32

CloseHandle ConvertFiberToThread ConvertThreadToFiber CreateFiber DeleteCriticalSection DeleteFiber EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetFileType GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetStdHandle GetSystemTime GetSystemTimeAsFileTime GetTickCount GetVersion GlobalMemoryStatus InitializeCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar QueryPerformanceCounter ReadConsoleA ReadConsoleW SetConsoleMode SetLastError SetUnhandledExceptionFilter Sleep SwitchToFiber SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteFile

msvcrt

__dllonexit _amsg_exit _chmod _errno _exit _fileno _fstat _initterm _iob _lock _onexit _setmode _snwprintf _stat time gmtime _stricmp _strnicmp calloc fclose feof ferror fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwrite getenv isalnum isspace isupper isxdigit malloc memchr memcmp memcpy memmove memset perror qsort raise realloc setbuf signal sprintf sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strrchr strspn strtol strtoul _unlock _vsnwprintf _wfopen abort atoi tolower vfprintf wcscpy wcsstr _vsnprintf _strdup

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

WSACleanup WSAGetLastError WSASetLastError WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname getnameinfo getsockname getsockopt ioctlsocket listen ntohs recv recvfrom send sendto setsockopt shutdown socket

ACCESS_DESCRIPTION_free ACCESS_DESCRIPTION_it ACCESS_DESCRIPTION_new AES_bi_ige_encrypt AES_cbc_encrypt AES_cfb128_encrypt AES_cfb1_encrypt AES_cfb8_encrypt AES_decrypt AES_ecb_encrypt AES_encrypt AES_ige_encrypt AES_ofb128_encrypt AES_options AES_set_decrypt_key AES_set_encrypt_key AES_unwrap_key AES_wrap_key ASIdOrRange_free ASIdOrRange_it ASIdOrRange_new ASIdentifierChoice_free ASIdentifierChoice_it ASIdentifierChoice_new ASIdentifiers_free ASIdentifiers_it ASIdentifiers_new ASN1_ANY_it ASN1_BIT_STRING_check ASN1_BIT_STRING_free ASN1_BIT_STRING_get_bit ASN1_BIT_STRING_it ASN1_BIT_STRING_name_print ASN1_BIT_STRING_new ASN1_BIT_STRING_num_asc ASN1_BIT_STRING_set ASN1_BIT_STRING_set_asc ASN1_BIT_STRING_set_bit ASN1_BMPSTRING_free ASN1_BMPSTRING_it ASN1_BMPSTRING_new ASN1_BOOLEAN_it ASN1_ENUMERATED_free ASN1_ENUMERATED_get ASN1_ENUMERATED_get_int64 ASN1_ENUMERATED_it ASN1_ENUMERATED_new ASN1_ENUMERATED_set ASN1_ENUMERATED_set_int64 ASN1_ENUMERATED_to_BN ASN1_FBOOLEAN_it ASN1_GENERALIZEDTIME_adj ASN1_GENERALIZEDTIME_check ASN1_GENERALIZEDTIME_free ASN1_GENERALIZEDTIME_it ASN1_GENERALIZEDTIME_new ASN1_GENERALIZEDTIME_print ASN1_GENERALIZEDTIME_set ASN1_GENERALIZEDTIME_set_string ASN1_GENERALSTRING_free ASN1_GENERALSTRING_it ASN1_GENERALSTRING_new ASN1_IA5STRING_free ASN1_IA5STRING_it ASN1_IA5STRING_new ASN1_INTEGER_cmp ASN1_INTEGER_dup ASN1_INTEGER_free ASN1_INTEGER_get ASN1_INTEGER_get_int64 ASN1_INTEGER_get_uint64 ASN1_INTEGER_it ASN1_INTEGER_new ASN1_INTEGER_set ASN1_INTEGER_set_int64 ASN1_INTEGER_set_uint64 ASN1_INTEGER_to_BN ASN1_NULL_free ASN1_NULL_it ASN1_NULL_new ASN1_OBJECT_create ASN1_OBJECT_free ASN1_OBJECT_it ASN1_OBJECT_new ASN1_OCTET_STRING_NDEF_it ASN1_OCTET_STRING_cmp ASN1_OCTET_STRING_dup ASN1_OCTET_STRING_free ASN1_OCTET_STRING_it ASN1_OCTET_STRING_new ASN1_OCTET_STRING_set ASN1_PCTX_free ASN1_PCTX_get_cert_flags ASN1_PCTX_get_flags ASN1_PCTX_get_nm_flags ASN1_PCTX_get_oid_flags ASN1_PCTX_get_str_flags ASN1_PCTX_new ASN1_PCTX_set_cert_flags ASN1_PCTX_set_flags ASN1_PCTX_set_nm_flags ASN1_PCTX_set_oid_flags ASN1_PCTX_set_str_flags ASN1_PRINTABLESTRING_free ASN1_PRINTABLESTRING_it ASN1_PRINTABLESTRING_new ASN1_PRINTABLE_free ASN1_PRINTABLE_it ASN1_PRINTABLE_new ASN1_PRINTABLE_type ASN1_SCTX_free ASN1_SCTX_get_app_data ASN1_SCTX_get_flags ASN1_SCTX_get_item ASN1_SCTX_get_template ASN1_SCTX_new ASN1_SCTX_set_app_data ASN1_SEQUENCE_ANY_it ASN1_SEQUENCE_it ASN1_SET_ANY_it ASN1_STRING_TABLE_add ASN1_STRING_TABLE_cleanup ASN1_STRING_TABLE_get ASN1_STRING_clear_free ASN1_STRING_cmp ASN1_STRING_copy ASN1_STRING_data ASN1_STRING_dup ASN1_STRING_free ASN1_STRING_get0_data ASN1_STRING_get_default_mask ASN1_STRING_length ASN1_STRING_length_set ASN1_STRING_new ASN1_STRING_print ASN1_STRING_print_ex ASN1_STRING_print_ex_fp ASN1_STRING_set ASN1_STRING_set0 ASN1_STRING_set_by_NID ASN1_STRING_set_default_mask ASN1_STRING_set_default_mask_asc ASN1_STRING_to_UTF8 ASN1_STRING_type ASN1_STRING_type_new ASN1_T61STRING_free ASN1_T61STRING_it ASN1_T61STRING_new ASN1_TBOOLEAN_it ASN1_TIME_adj ASN1_TIME_check ASN1_TIME_diff ASN1_TIME_free ASN1_TIME_it ASN1_TIME_new ASN1_TIME_print ASN1_TIME_set ASN1_TIME_set_string ASN1_TIME_to_generalizedtime ASN1_TYPE_cmp ASN1_TYPE_free ASN1_TYPE_get ASN1_TYPE_get_int_octetstring ASN1_TYPE_get_octetstring ASN1_TYPE_new ASN1_TYPE_pack_sequence ASN1_TYPE_set ASN1_TYPE_set1 ASN1_TYPE_set_int_octetstring ASN1_TYPE_set_octetstring ASN1_TYPE_unpack_sequence ASN1_UNIVERSALSTRING_free ASN1_UNIVERSALSTRING_it ASN1_UNIVERSALSTRING_new ASN1_UNIVERSALSTRING_to_string ASN1_UTCTIME_adj ASN1_UTCTIME_check ASN1_UTCTIME_cmp_time_t ASN1_UTCTIME_free ASN1_UTCTIME_it ASN1_UTCTIME_new ASN1_UTCTIME_print ASN1_UTCTIME_set ASN1_UTCTIME_set_string ASN1_UTF8STRING_free ASN1_UTF8STRING_it ASN1_UTF8STRING_new ASN1_VISIBLESTRING_free ASN1_VISIBLESTRING_it ASN1_VISIBLESTRING_new ASN1_add_oid_module ASN1_add_stable_module ASN1_bn_print ASN1_buf_print ASN1_check_infinite_end ASN1_const_check_infinite_end ASN1_d2i_bio ASN1_d2i_fp ASN1_digest ASN1_dup ASN1_generate_nconf ASN1_generate_v3 ASN1_get_object ASN1_i2d_bio ASN1_i2d_fp ASN1_item_d2i ASN1_item_d2i_bio ASN1_item_d2i_fp ASN1_item_digest ASN1_item_dup ASN1_item_ex_d2i ASN1_item_ex_free ASN1_item_ex_i2d ASN1_item_ex_new ASN1_item_free ASN1_item_i2d ASN1_item_i2d_bio ASN1_item_i2d_fp ASN1_item_ndef_i2d ASN1_item_new ASN1_item_pack ASN1_item_print ASN1_item_sign ASN1_item_sign_ctx ASN1_item_unpack ASN1_item_verify ASN1_mbstring_copy ASN1_mbstring_ncopy ASN1_object_size ASN1_parse ASN1_parse_dump ASN1_put_eoc ASN1_put_object ASN1_sign ASN1_str2mask ASN1_tag2bit ASN1_tag2str ASN1_verify ASRange_free ASRange_it ASRange_new ASYNC_WAIT_CTX_clear_fd ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_WAIT_CTX_get_fd ASYNC_WAIT_CTX_new ASYNC_WAIT_CTX_set_wait_fd ASYNC_block_pause ASYNC_cleanup_thread ASYNC_get_current_job ASYNC_get_wait_ctx ASYNC_init_thread ASYNC_is_capable ASYNC_pause_job ASYNC_start_job ASYNC_unblock_pause AUTHORITY_INFO_ACCESS_free AUTHORITY_INFO_ACCESS_it AUTHORITY_INFO_ACCESS_new AUTHORITY_KEYID_free AUTHORITY_KEYID_it AUTHORITY_KEYID_new BASIC_CONSTRAINTS_free BASIC_CONSTRAINTS_it BASIC_CONSTRAINTS_new BF_cbc_encrypt BF_cfb64_encrypt BF_decrypt BF_ecb_encrypt BF_encrypt BF_ofb64_encrypt BF_options BF_set_key BIGNUM_it BIO_ADDRINFO_address BIO_ADDRINFO_family BIO_ADDRINFO_free BIO_ADDRINFO_next BIO_ADDRINFO_protocol BIO_ADDRINFO_socktype BIO_ADDR_clear BIO_ADDR_family BIO_ADDR_free BIO_ADDR_hostname_string BIO_ADDR_new BIO_ADDR_path_string BIO_ADDR_rawaddress BIO_ADDR_rawmake BIO_ADDR_rawport BIO_ADDR_service_string BIO_accept BIO_accept_ex BIO_asn1_get_prefix BIO_asn1_get_suffix BIO_asn1_set_prefix BIO_asn1_set_suffix BIO_callback_ctrl BIO_clear_flags BIO_closesocket BIO_connect BIO_copy_next_retry BIO_ctrl BIO_ctrl_get_read_request BIO_ctrl_get_write_guarantee BIO_ctrl_pending BIO_ctrl_reset_read_request BIO_ctrl_wpending BIO_debug_callback BIO_dgram_non_fatal_error BIO_dump BIO_dump_cb BIO_dump_fp BIO_dump_indent BIO_dump_indent_cb BIO_dump_indent_fp BIO_dup_chain BIO_f_asn1 BIO_f_base64 BIO_f_buffer BIO_f_cipher BIO_f_linebuffer BIO_f_md BIO_f_nbio_test BIO_f_null BIO_f_reliable BIO_fd_non_fatal_error BIO_fd_should_retry BIO_find_type BIO_free BIO_free_all BIO_get_accept_socket BIO_get_callback BIO_get_callback_arg BIO_get_data BIO_get_ex_data BIO_get_host_ip BIO_get_init BIO_get_new_index BIO_get_port BIO_get_retry_BIO BIO_get_retry_reason BIO_get_shutdown BIO_gethostbyname BIO_gets BIO_hex_string BIO_indent BIO_int_ctrl BIO_listen BIO_lookup BIO_meth_free BIO_meth_get_callback_ctrl BIO_meth_get_create BIO_meth_get_ctrl BIO_meth_get_destroy BIO_meth_get_gets BIO_meth_get_puts BIO_meth_get_read BIO_meth_get_write BIO_meth_new BIO_meth_set_callback_ctrl BIO_meth_set_create BIO_meth_set_ctrl BIO_meth_set_destroy BIO_meth_set_gets BIO_meth_set_puts BIO_meth_set_read BIO_meth_set_write BIO_method_name BIO_method_type BIO_new BIO_new_CMS BIO_new_NDEF BIO_new_PKCS7 BIO_new_accept BIO_new_bio_pair BIO_new_connect BIO_new_dgram BIO_new_fd BIO_new_file BIO_new_fp BIO_new_mem_buf BIO_new_socket BIO_next BIO_nread BIO_nread0 BIO_number_read BIO_number_written BIO_nwrite BIO_nwrite0 BIO_parse_hostserv BIO_pop BIO_printf BIO_ptr_ctrl BIO_push BIO_puts BIO_read BIO_s_accept BIO_s_bio BIO_s_connect BIO_s_datagram BIO_s_fd BIO_s_file BIO_s_mem BIO_s_null BIO_s_secmem BIO_s_socket BIO_set_callback BIO_set_callback_arg BIO_set_cipher BIO_set_data BIO_set_ex_data BIO_set_flags BIO_set_init BIO_set_next BIO_set_retry_reason BIO_set_shutdown BIO_set_tcp_ndelay BIO_snprintf BIO_sock_error BIO_sock_info BIO_sock_init BIO_sock_non_fatal_error BIO_sock_should_retry BIO_socket BIO_socket_ioctl BIO_socket_nbio BIO_test_flags BIO_up_ref BIO_vfree BIO_vprintf BIO_vsnprintf BIO_write BN_BLINDING_convert BN_BLINDING_convert_ex BN_BLINDING_create_param BN_BLINDING_free BN_BLINDING_get_flags BN_BLINDING_invert BN_BLINDING_invert_ex BN_BLINDING_is_current_thread BN_BLINDING_lock BN_BLINDING_new BN_BLINDING_set_current_thread BN_BLINDING_set_flags BN_BLINDING_unlock BN_BLINDING_update BN_CTX_end BN_CTX_free BN_CTX_get BN_CTX_new BN_CTX_secure_new BN_CTX_start BN_GENCB_call BN_GENCB_free BN_GENCB_get_arg BN_GENCB_new BN_GENCB_set BN_GENCB_set_old BN_GF2m_add BN_GF2m_arr2poly BN_GF2m_mod BN_GF2m_mod_arr BN_GF2m_mod_div BN_GF2m_mod_div_arr BN_GF2m_mod_exp BN_GF2m_mod_exp_arr BN_GF2m_mod_inv BN_GF2m_mod_inv_arr BN_GF2m_mod_mul BN_GF2m_mod_mul_arr BN_GF2m_mod_solve_quad BN_GF2m_mod_solve_quad_arr BN_GF2m_mod_sqr BN_GF2m_mod_sqr_arr BN_GF2m_mod_sqrt BN_GF2m_mod_sqrt_arr BN_GF2m_poly2arr BN_MONT_CTX_copy BN_MONT_CTX_free BN_MONT_CTX_new BN_MONT_CTX_set BN_MONT_CTX_set_locked BN_RECP_CTX_free BN_RECP_CTX_new BN_RECP_CTX_set BN_X931_derive_prime_ex BN_X931_generate_Xpq BN_X931_generate_prime_ex BN_abs_is_word BN_add BN_add_word BN_asc2bn BN_bin2bn BN_bn2bin BN_bn2binpad BN_bn2dec BN_bn2hex BN_bn2lebinpad BN_bn2mpi BN_bntest_rand BN_clear BN_clear_bit BN_clear_free BN_cmp BN_consttime_swap BN_copy BN_dec2bn BN_div BN_div_recp BN_div_word BN_dup BN_exp BN_free BN_from_montgomery BN_gcd BN_generate_dsa_nonce BN_generate_prime BN_generate_prime_ex BN_get0_nist_prime_192 BN_get0_nist_prime_224 BN_get0_nist_prime_256 BN_get0_nist_prime_384 BN_get0_nist_prime_521 BN_get_flags BN_get_params BN_get_rfc2409_prime_1024 BN_get_rfc2409_prime_768 BN_get_rfc3526_prime_1536 BN_get_rfc3526_prime_2048 BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_4096 BN_get_rfc3526_prime_6144 BN_get_rfc3526_prime_8192 BN_get_word BN_hex2bn BN_is_bit_set BN_is_negative BN_is_odd BN_is_one BN_is_prime BN_is_prime_ex BN_is_prime_fasttest BN_is_prime_fasttest_ex BN_is_word BN_is_zero BN_kronecker BN_lebin2bn BN_lshift BN_lshift1 BN_mask_bits BN_mod_add BN_mod_add_quick BN_mod_exp BN_mod_exp2_mont BN_mod_exp_mont BN_mod_exp_mont_consttime BN_mod_exp_mont_word BN_mod_exp_recp BN_mod_exp_simple BN_mod_inverse BN_mod_lshift BN_mod_lshift1 BN_mod_lshift1_quick BN_mod_lshift_quick BN_mod_mul BN_mod_mul_montgomery BN_mod_mul_reciprocal BN_mod_sqr BN_mod_sqrt BN_mod_sub BN_mod_sub_quick BN_mod_word BN_mpi2bn BN_mul BN_mul_word BN_new BN_nist_mod_192 BN_nist_mod_224 BN_nist_mod_256 BN_nist_mod_384 BN_nist_mod_521 BN_nist_mod_func BN_nnmod BN_num_bits BN_num_bits_word BN_options BN_print BN_print_fp BN_pseudo_rand BN_pseudo_rand_range BN_rand BN_rand_range BN_reciprocal BN_rshift BN_rshift1 BN_secure_new BN_security_bits BN_set_bit BN_set_flags BN_set_negative BN_set_params BN_set_word BN_sqr BN_sub BN_sub_word BN_swap BN_to_ASN1_ENUMERATED BN_to_ASN1_INTEGER BN_to_montgomery BN_uadd BN_ucmp BN_usub BN_value_one BN_with_flags BN_zero_ex BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_MEM_new_ex BUF_reverse CAST_cbc_encrypt CAST_cfb64_encrypt CAST_decrypt CAST_ecb_encrypt CAST_encrypt CAST_ofb64_encrypt CAST_set_key CBIGNUM_it CERTIFICATEPOLICIES_free CERTIFICATEPOLICIES_it CERTIFICATEPOLICIES_new CMAC_CTX_cleanup CMAC_CTX_copy CMAC_CTX_free CMAC_CTX_get0_cipher_ctx CMAC_CTX_new CMAC_Final CMAC_Init CMAC_Update CMAC_resume CMS_ContentInfo_free CMS_ContentInfo_it CMS_ContentInfo_new CMS_ContentInfo_print_ctx CMS_EncryptedData_decrypt CMS_EncryptedData_encrypt CMS_EncryptedData_set1_key CMS_EnvelopedData_create CMS_ReceiptRequest_create0 CMS_ReceiptRequest_free CMS_ReceiptRequest_get0_values CMS_ReceiptRequest_it CMS_ReceiptRequest_new CMS_RecipientEncryptedKey_cert_cmp CMS_RecipientEncryptedKey_get0_id CMS_RecipientInfo_decrypt CMS_RecipientInfo_encrypt CMS_RecipientInfo_get0_pkey_ctx CMS_RecipientInfo_kari_decrypt CMS_RecipientInfo_kari_get0_alg CMS_RecipientInfo_kari_get0_ctx CMS_RecipientInfo_kari_get0_orig_id CMS_RecipientInfo_kari_get0_reks CMS_RecipientInfo_kari_orig_id_cmp CMS_RecipientInfo_kari_set0_pkey CMS_RecipientInfo_kekri_get0_id CMS_RecipientInfo_kekri_id_cmp CMS_RecipientInfo_ktri_cert_cmp CMS_RecipientInfo_ktri_get0_algs CMS_RecipientInfo_ktri_get0_signer_id CMS_RecipientInfo_set0_key CMS_RecipientInfo_set0_password CMS_RecipientInfo_set0_pkey CMS_RecipientInfo_type CMS_SharedInfo_encode CMS_SignedData_init CMS_SignerInfo_cert_cmp CMS_SignerInfo_get0_algs CMS_SignerInfo_get0_md_ctx CMS_SignerInfo_get0_pkey_ctx CMS_SignerInfo_get0_signature CMS_SignerInfo_get0_signer_id CMS_SignerInfo_set1_signer_cert CMS_SignerInfo_sign CMS_SignerInfo_verify CMS_SignerInfo_verify_content CMS_add0_CertificateChoices CMS_add0_RevocationInfoChoice CMS_add0_cert CMS_add0_crl CMS_add0_recipient_key CMS_add0_recipient_password CMS_add1_ReceiptRequest CMS_add1_cert CMS_add1_crl CMS_add1_recipient_cert CMS_add1_signer CMS_add_simple_smimecap CMS_add_smimecap CMS_add_standard_smimecap CMS_compress CMS_data CMS_dataFinal CMS_dataInit CMS_data_create CMS_decrypt CMS_decrypt_set1_key CMS_decrypt_set1_password CMS_decrypt_set1_pkey CMS_digest_create CMS_digest_verify CMS_encrypt CMS_final CMS_get0_RecipientInfos CMS_get0_SignerInfos CMS_get0_content CMS_get0_eContentType CMS_get0_signers CMS_get0_type CMS_get1_ReceiptRequest CMS_get1_certs CMS_get1_crls CMS_is_detached CMS_set1_eContentType CMS_set1_signers_certs CMS_set_detached CMS_sign CMS_sign_receipt CMS_signed_add1_attr CMS_signed_add1_attr_by_NID CMS_signed_add1_attr_by_OBJ CMS_signed_add1_attr_by_txt CMS_signed_delete_attr CMS_signed_get0_data_by_OBJ CMS_signed_get_attr CMS_signed_get_attr_by_NID CMS_signed_get_attr_by_OBJ CMS_signed_get_attr_count CMS_stream CMS_uncompress CMS_unsigned_add1_attr CMS_unsigned_add1_attr_by_NID CMS_unsigned_add1_attr_by_OBJ CMS_unsigned_add1_attr_by_txt CMS_unsigned_delete_attr CMS_unsigned_get0_data_by_OBJ CMS_unsigned_get_attr CMS_unsigned_get_attr_by_NID CMS_unsigned_get_attr_by_OBJ CMS_unsigned_get_attr_count CMS_verify CMS_verify_receipt COMP_CTX_free COMP_CTX_get_method COMP_CTX_get_type COMP_CTX_new COMP_compress_block COMP_expand_block COMP_get_name COMP_get_type COMP_zlib CONF_dump_bio CONF_dump_fp CONF_free CONF_get1_default_config_file CONF_get_number CONF_get_section CONF_get_string CONF_imodule_get_flags CONF_imodule_get_module CONF_imodule_get_name CONF_imodule_get_usr_data CONF_imodule_get_value CONF_imodule_set_flags CONF_imodule_set_usr_data CONF_load CONF_load_bio CONF_load_fp CONF_module_add CONF_module_get_usr_data CONF_module_set_usr_data CONF_modules_finish CONF_modules_load CONF_modules_load_file CONF_modules_unload CONF_parse_list CONF_set_default_method CONF_set_nconf CRL_DIST_POINTS_free CRL_DIST_POINTS_it CRL_DIST_POINTS_new CRYPTO_128_unwrap CRYPTO_128_unwrap_pad CRYPTO_128_wrap CRYPTO_128_wrap_pad CRYPTO_THREAD_cleanup_local CRYPTO_THREAD_compare_id CRYPTO_THREAD_get_current_id CRYPTO_THREAD_get_local CRYPTO_THREAD_init_local CRYPTO_THREAD_lock_free CRYPTO_THREAD_lock_new CRYPTO_THREAD_read_lock CRYPTO_THREAD_run_once CRYPTO_THREAD_set_local CRYPTO_THREAD_unlock CRYPTO_THREAD_write_lock CRYPTO_atomic_add CRYPTO_cbc128_decrypt CRYPTO_cbc128_encrypt CRYPTO_ccm128_aad CRYPTO_ccm128_decrypt CRYPTO_ccm128_decrypt_ccm64 CRYPTO_ccm128_encrypt CRYPTO_ccm128_encrypt_ccm64 CRYPTO_ccm128_init CRYPTO_ccm128_setiv CRYPTO_ccm128_tag CRYPTO_cfb128_1_encrypt CRYPTO_cfb128_8_encrypt CRYPTO_cfb128_encrypt CRYPTO_clear_free CRYPTO_clear_realloc CRYPTO_ctr128_encrypt CRYPTO_ctr128_encrypt_ctr32 CRYPTO_cts128_decrypt CRYPTO_cts128_decrypt_block CRYPTO_cts128_encrypt CRYPTO_cts128_encrypt_block CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_free_ex_index CRYPTO_gcm128_aad CRYPTO_gcm128_decrypt CRYPTO_gcm128_decrypt_ctr32 CRYPTO_gcm128_encrypt CRYPTO_gcm128_encrypt_ctr32 CRYPTO_gcm128_finish CRYPTO_gcm128_init CRYPTO_gcm128_new CRYPTO_gcm128_release CRYPTO_gcm128_setiv CRYPTO_gcm128_tag CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_get_mem_functions CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_memdup CRYPTO_new_ex_data CRYPTO_nistcts128_decrypt CRYPTO_nistcts128_decrypt_block CRYPTO_nistcts128_encrypt CRYPTO_nistcts128_encrypt_block CRYPTO_ocb128_aad CRYPTO_ocb128_cleanup CRYPTO_ocb128_copy_ctx CRYPTO_ocb128_decrypt CRYPTO_ocb128_encrypt CRYPTO_ocb128_finish CRYPTO_ocb128_init CRYPTO_ocb128_new CRYPTO_ocb128_setiv CRYPTO_ocb128_tag CRYPTO_ofb128_encrypt CRYPTO_realloc CRYPTO_secure_actual_size CRYPTO_secure_allocated CRYPTO_secure_clear_free CRYPTO_secure_free CRYPTO_secure_malloc CRYPTO_secure_malloc_done CRYPTO_secure_malloc_init CRYPTO_secure_malloc_initialized CRYPTO_secure_used CRYPTO_secure_zalloc CRYPTO_set_ex_data CRYPTO_set_mem_debug CRYPTO_set_mem_functions CRYPTO_strdup CRYPTO_strndup CRYPTO_xts128_encrypt CRYPTO_zalloc CTLOG_STORE_free CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file CTLOG_STORE_load_file CTLOG_STORE_new CTLOG_free CTLOG_get0_log_id CTLOG_get0_name CTLOG_get0_public_key CTLOG_new CTLOG_new_from_base64 CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_get0_cert CT_POLICY_EVAL_CTX_get0_issuer CT_POLICY_EVAL_CTX_get0_log_store CT_POLICY_EVAL_CTX_get_time CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time Camellia_cbc_encrypt Camellia_cfb128_encrypt Camellia_cfb1_encrypt Camellia_cfb8_encrypt Camellia_ctr128_encrypt Camellia_decrypt Camellia_ecb_encrypt Camellia_encrypt Camellia_ofb128_encrypt Camellia_set_key DES_cbc_cksum DES_cbc_encrypt DES_cfb64_encrypt DES_cfb_encrypt DES_check_key_parity DES_crypt DES_decrypt3 DES_ecb3_encrypt DES_ecb_encrypt DES_ede3_cbc_encrypt DES_ede3_cfb64_encrypt DES_ede3_cfb_encrypt DES_ede3_ofb64_encrypt DES_encrypt1 DES_encrypt2 DES_encrypt3 DES_fcrypt DES_is_weak_key DES_key_sched DES_ncbc_encrypt DES_ofb64_encrypt DES_ofb_encrypt DES_options DES_pcbc_encrypt DES_quad_cksum DES_random_key DES_set_key DES_set_key_checked DES_set_key_unchecked DES_set_odd_parity DES_string_to_2keys DES_string_to_key DES_xcbc_encrypt DH_KDF_X9_42 DH_OpenSSL DH_bits DH_check DH_check_params DH_check_pub_key DH_clear_flags DH_compute_key DH_compute_key_padded DH_free DH_generate_key DH_generate_parameters DH_generate_parameters_ex DH_get0_engine DH_get0_key DH_get0_pqg DH_get_1024_160 DH_get_2048_224 DH_get_2048_256 DH_get_default_method DH_get_ex_data DH_get_length DH_meth_dup DH_meth_free DH_meth_get0_app_data DH_meth_get0_name DH_meth_get_bn_mod_exp DH_meth_get_compute_key DH_meth_get_finish DH_meth_get_flags DH_meth_get_generate_key DH_meth_get_generate_params DH_meth_get_init DH_meth_new DH_meth_set0_app_data DH_meth_set1_name DH_meth_set_bn_mod_exp DH_meth_set_compute_key DH_meth_set_finish DH_meth_set_flags DH_meth_set_generate_key DH_meth_set_generate_params DH_meth_set_init DH_new DH_new_method DH_security_bits DH_set0_key DH_set0_pqg DH_set_default_method DH_set_ex_data DH_set_flags DH_set_length DH_set_method DH_size DH_test_flags DH_up_ref DHparams_dup DHparams_it DHparams_print DHparams_print_fp DIRECTORYSTRING_free DIRECTORYSTRING_it DIRECTORYSTRING_new DISPLAYTEXT_free DISPLAYTEXT_it DISPLAYTEXT_new DIST_POINT_NAME_free DIST_POINT_NAME_it DIST_POINT_NAME_new DIST_POINT_free DIST_POINT_it DIST_POINT_new DIST_POINT_set_dpname DSA_OpenSSL DSA_SIG_free DSA_SIG_get0 DSA_SIG_new DSA_SIG_set0 DSA_bits DSA_clear_flags DSA_do_sign DSA_do_verify DSA_dup_DH DSA_free DSA_generate_key DSA_generate_parameters DSA_generate_parameters_ex DSA_get0_engine DSA_get0_key DSA_get0_pqg DSA_get_default_method DSA_get_ex_data DSA_get_method DSA_meth_dup DSA_meth_free DSA_meth_get0_app_data DSA_meth_get0_name DSA_meth_get_bn_mod_exp DSA_meth_get_finish DSA_meth_get_flags DSA_meth_get_init DSA_meth_get_keygen DSA_meth_get_mod_exp DSA_meth_get_paramgen DSA_meth_get_sign DSA_meth_get_sign_setup DSA_meth_get_verify DSA_meth_new DSA_meth_set0_app_data DSA_meth_set1_name DSA_meth_set_bn_mod_exp DSA_meth_set_finish DSA_meth_set_flags DSA_meth_set_init DSA_meth_set_keygen DSA_meth_set_mod_exp DSA_meth_set_paramgen DSA_meth_set_sign DSA_meth_set_sign_setup DSA_meth_set_verify DSA_new DSA_new_method DSA_print DSA_print_fp DSA_security_bits DSA_set0_key DSA_set0_pqg DSA_set_default_method DSA_set_ex_data DSA_set_flags DSA_set_method DSA_sign DSA_sign_setup DSA_size DSA_test_flags DSA_up_ref DSA_verify DSAparams_dup DSAparams_print DSAparams_print_fp DSO_METHOD_openssl DSO_bind_func DSO_convert_filename DSO_ctrl DSO_dsobyaddr DSO_flags DSO_free DSO_get_filename DSO_global_lookup DSO_load DSO_merge DSO_new DSO_pathbyaddr DSO_set_filename DSO_up_ref ECDH_KDF_X9_62 ECDH_compute_key ECDSA_SIG_free ECDSA_SIG_get0 ECDSA_SIG_new ECDSA_SIG_set0 ECDSA_do_sign ECDSA_do_sign_ex ECDSA_do_verify ECDSA_sign ECDSA_sign_ex ECDSA_sign_setup ECDSA_size ECDSA_verify ECPARAMETERS_free ECPARAMETERS_it ECPARAMETERS_new ECPKPARAMETERS_free ECPKPARAMETERS_it ECPKPARAMETERS_new ECPKParameters_print ECPKParameters_print_fp ECParameters_print ECParameters_print_fp EC_GF2m_simple_method EC_GFp_mont_method EC_GFp_nist_method EC_GFp_simple_method EC_GROUP_check EC_GROUP_check_discriminant EC_GROUP_clear_free EC_GROUP_cmp EC_GROUP_copy EC_GROUP_dup EC_GROUP_free EC_GROUP_get0_cofactor EC_GROUP_get0_generator EC_GROUP_get0_order EC_GROUP_get0_seed EC_GROUP_get_asn1_flag EC_GROUP_get_basis_type EC_GROUP_get_cofactor EC_GROUP_get_curve_GF2m EC_GROUP_get_curve_GFp EC_GROUP_get_curve_name EC_GROUP_get_degree EC_GROUP_get_ecparameters EC_GROUP_get_ecpkparameters EC_GROUP_get_mont_data EC_GROUP_get_order EC_GROUP_get_pentanomial_basis EC_GROUP_get_point_conversion_form EC_GROUP_get_seed_len EC_GROUP_get_trinomial_basis EC_GROUP_have_precompute_mult EC_GROUP_method_of EC_GROUP_new EC_GROUP_new_by_curve_name EC_GROUP_new_curve_GF2m EC_GROUP_new_curve_GFp EC_GROUP_new_from_ecparameters EC_GROUP_new_from_ecpkparameters EC_GROUP_order_bits EC_GROUP_precompute_mult EC_GROUP_set_asn1_flag EC_GROUP_set_curve_GF2m EC_GROUP_set_curve_GFp EC_GROUP_set_curve_name EC_GROUP_set_generator EC_GROUP_set_point_conversion_form EC_GROUP_set_seed EC_KEY_METHOD_free EC_KEY_METHOD_get_compute_key EC_KEY_METHOD_get_init EC_KEY_METHOD_get_keygen EC_KEY_METHOD_get_sign EC_KEY_METHOD_get_verify EC_KEY_METHOD_new EC_KEY_METHOD_set_compute_key EC_KEY_METHOD_set_init EC_KEY_METHOD_set_keygen EC_KEY_METHOD_set_sign EC_KEY_METHOD_set_verify EC_KEY_OpenSSL EC_KEY_can_sign EC_KEY_check_key EC_KEY_clear_flags EC_KEY_copy EC_KEY_dup EC_KEY_free EC_KEY_generate_key EC_KEY_get0_group EC_KEY_get0_private_key EC_KEY_get0_public_key EC_KEY_get_conv_form EC_KEY_get_default_method EC_KEY_get_enc_flags EC_KEY_get_ex_data EC_KEY_get_flags EC_KEY_get_method EC_KEY_key2buf EC_KEY_new EC_KEY_new_by_curve_name EC_KEY_new_method EC_KEY_oct2key EC_KEY_oct2priv EC_KEY_precompute_mult EC_KEY_print EC_KEY_print_fp EC_KEY_priv2buf EC_KEY_priv2oct EC_KEY_set_asn1_flag EC_KEY_set_conv_form EC_KEY_set_default_method EC_KEY_set_enc_flags EC_KEY_set_ex_data EC_KEY_set_flags EC_KEY_set_group EC_KEY_set_method EC_KEY_set_private_key EC_KEY_set_public_key EC_KEY_set_public_key_affine_coordinates EC_KEY_up_ref EC_METHOD_get_field_type EC_POINT_add EC_POINT_bn2point EC_POINT_clear_free EC_POINT_cmp EC_POINT_copy EC_POINT_dbl EC_POINT_dup EC_POINT_free EC_POINT_get_Jprojective_coordinates_GFp EC_POINT_get_affine_coordinates_GF2m EC_POINT_get_affine_coordinates_GFp EC_POINT_hex2point EC_POINT_invert EC_POINT_is_at_infinity EC_POINT_is_on_curve EC_POINT_make_affine EC_POINT_method_of EC_POINT_mul EC_POINT_new EC_POINT_oct2point EC_POINT_point2bn EC_POINT_point2buf EC_POINT_point2hex EC_POINT_point2oct EC_POINT_set_Jprojective_coordinates_GFp EC_POINT_set_affine_coordinates_GF2m EC_POINT_set_affine_coordinates_GFp EC_POINT_set_compressed_coordinates_GF2m EC_POINT_set_compressed_coordinates_GFp EC_POINT_set_to_infinity EC_POINTs_make_affine EC_POINTs_mul EC_curve_nid2nist EC_curve_nist2nid EC_get_builtin_curves EDIPARTYNAME_free EDIPARTYNAME_it EDIPARTYNAME_new ENGINE_add ENGINE_add_conf_module ENGINE_by_id ENGINE_cmd_is_executable ENGINE_ctrl ENGINE_ctrl_cmd ENGINE_ctrl_cmd_string ENGINE_finish ENGINE_free ENGINE_get_DH ENGINE_get_DSA ENGINE_get_EC ENGINE_get_RAND ENGINE_get_RSA ENGINE_get_cipher ENGINE_get_cipher_engine ENGINE_get_ciphers ENGINE_get_cmd_defns ENGINE_get_ctrl_function ENGINE_get_default_DH ENGINE_get_default_DSA ENGINE_get_default_EC ENGINE_get_default_RAND ENGINE_get_default_RSA ENGINE_get_destroy_function ENGINE_get_digest ENGINE_get_digest_engine ENGINE_get_digests ENGINE_get_ex_data ENGINE_get_finish_function ENGINE_get_first ENGINE_get_flags ENGINE_get_id ENGINE_get_init_function ENGINE_get_last ENGINE_get_load_privkey_function ENGINE_get_load_pubkey_function ENGINE_get_name ENGINE_get_next ENGINE_get_pkey_asn1_meth ENGINE_get_pkey_asn1_meth_engine ENGINE_get_pkey_asn1_meth_str ENGINE_get_pkey_asn1_meths ENGINE_get_pkey_meth ENGINE_get_pkey_meth_engine ENGINE_get_pkey_meths ENGINE_get_prev ENGINE_get_ssl_client_cert_function ENGINE_get_static_state ENGINE_get_table_flags ENGINE_init ENGINE_load_builtin_engines ENGINE_load_private_key ENGINE_load_public_key ENGINE_load_ssl_client_cert ENGINE_new ENGINE_pkey_asn1_find_str ENGINE_register_DH ENGINE_register_DSA ENGINE_register_EC ENGINE_register_RAND ENGINE_register_RSA ENGINE_register_all_DH ENGINE_register_all_DSA ENGINE_register_all_EC ENGINE_register_all_RAND ENGINE_register_all_RSA ENGINE_register_all_ciphers ENGINE_register_all_complete ENGINE_register_all_digests ENGINE_register_all_pkey_asn1_meths ENGINE_register_all_pkey_meths ENGINE_register_ciphers ENGINE_register_complete ENGINE_register_digests ENGINE_register_pkey_asn1_meths ENGINE_register_pkey_meths ENGINE_remove ENGINE_set_DH ENGINE_set_DSA ENGINE_set_EC ENGINE_set_RAND ENGINE_set_RSA ENGINE_set_ciphers ENGINE_set_cmd_defns ENGINE_set_ctrl_function ENGINE_set_default ENGINE_set_default_DH ENGINE_set_default_DSA ENGINE_set_default_EC ENGINE_set_default_RAND ENGINE_set_default_RSA ENGINE_set_default_ciphers ENGINE_set_default_digests ENGINE_set_default_pkey_asn1_meths ENGINE_set_default_pkey_meths ENGINE_set_default_string ENGINE_set_destroy_function ENGINE_set_digests ENGINE_set_ex_data ENGINE_set_finish_function ENGINE_set_flags ENGINE_set_id ENGINE_set_init_function ENGINE_set_load_privkey_function ENGINE_set_load_pubkey_function ENGINE_set_load_ssl_client_cert_function ENGINE_set_name ENGINE_set_pkey_asn1_meths ENGINE_set_pkey_meths ENGINE_set_table_flags ENGINE_unregister_DH ENGINE_unregister_DSA ENGINE_unregister_EC ENGINE_unregister_RAND ENGINE_unregister_RSA ENGINE_unregister_ciphers ENGINE_unregister_digests ENGINE_unregister_pkey_asn1_meths ENGINE_unregister_pkey_meths ENGINE_up_ref ERR_add_error_data ERR_add_error_vdata ERR_clear_error ERR_error_string ERR_error_string_n ERR_func_error_string ERR_get_error ERR_get_error_line ERR_get_error_line_data ERR_get_next_error_library ERR_get_state ERR_lib_error_string ERR_load_ASN1_strings ERR_load_ASYNC_strings ERR_load_BIO_strings ERR_load_BN_strings ERR_load_BUF_strings ERR_load_CMS_strings ERR_load_COMP_strings ERR_load_CONF_strings ERR_load_CRYPTO_strings ERR_load_CT_strings ERR_load_DH_strings ERR_load_DSA_strings ERR_load_DSO_strings ERR_load_EC_strings ERR_load_ENGINE_strings ERR_load_ERR_strings ERR_load_EVP_strings ERR_load_KDF_strings ERR_load_OBJ_strings ERR_load_OCSP_strings ERR_load_PEM_strings ERR_load_PKCS12_strings ERR_load_PKCS7_strings ERR_load_RAND_strings ERR_load_RSA_strings ERR_load_TS_strings ERR_load_UI_strings ERR_load_X509V3_strings ERR_load_X509_strings ERR_load_strings ERR_peek_error ERR_peek_error_line ERR_peek_error_line_data ERR_peek_last_error ERR_peek_last_error_line ERR_peek_last_error_line_data ERR_pop_to_mark ERR_print_errors ERR_print_errors_cb ERR_print_errors_fp ERR_put_error ERR_reason_error_string ERR_remove_state ERR_remove_thread_state ERR_set_error_data ERR_set_mark ERR_unload_strings ESS_CERT_ID_dup ESS_CERT_ID_free ESS_CERT_ID_new ESS_ISSUER_SERIAL_dup ESS_ISSUER_SERIAL_free ESS_ISSUER_SERIAL_new ESS_SIGNING_CERT_dup ESS_SIGNING_CERT_free ESS_SIGNING_CERT_new EVP_BytesToKey EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_buf_noconst EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_clear_flags EVP_CIPHER_CTX_copy EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_encrypting EVP_CIPHER_CTX_free EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_iv EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_iv_noconst EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_nid EVP_CIPHER_CTX_num EVP_CIPHER_CTX_original_iv EVP_CIPHER_CTX_rand_key EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_set_cipher_data EVP_CIPHER_CTX_set_flags EVP_CIPHER_CTX_set_key_length EVP_CIPHER_CTX_set_num EVP_CIPHER_CTX_set_padding EVP_CIPHER_CTX_test_flags EVP_CIPHER_asn1_to_param EVP_CIPHER_block_size EVP_CIPHER_do_all EVP_CIPHER_do_all_sorted EVP_CIPHER_flags EVP_CIPHER_get_asn1_iv EVP_CIPHER_impl_ctx_size EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_meth_dup EVP_CIPHER_meth_free EVP_CIPHER_meth_get_cleanup EVP_CIPHER_meth_get_ctrl EVP_CIPHER_meth_get_do_cipher EVP_CIPHER_meth_get_get_asn1_params EVP_CIPHER_meth_get_init EVP_CIPHER_meth_get_set_asn1_params EVP_CIPHER_meth_new EVP_CIPHER_meth_set_cleanup EVP_CIPHER_meth_set_ctrl EVP_CIPHER_meth_set_do_cipher EVP_CIPHER_meth_set_flags EVP_CIPHER_meth_set_get_asn1_params EVP_CIPHER_meth_set_impl_ctx_size EVP_CIPHER_meth_set_init EVP_CIPHER_meth_set_iv_length EVP_CIPHER_meth_set_set_asn1_params EVP_CIPHER_nid EVP_CIPHER_param_to_asn1 EVP_CIPHER_set_asn1_iv EVP_CIPHER_type EVP_Cipher EVP_CipherFinal EVP_CipherFinal_ex EVP_CipherInit EVP_CipherInit_ex EVP_CipherUpdate EVP_DecodeBlock EVP_DecodeFinal EVP_DecodeInit EVP_DecodeUpdate EVP_DecryptFinal EVP_DecryptFinal_ex EVP_DecryptInit EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerifyFinal EVP_DigestVerifyInit EVP_ENCODE_CTX_copy EVP_ENCODE_CTX_free EVP_ENCODE_CTX_new EVP_ENCODE_CTX_num EVP_EncodeBlock EVP_EncodeFinal EVP_EncodeInit EVP_EncodeUpdate EVP_EncryptFinal EVP_EncryptFinal_ex EVP_EncryptInit EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_clear_flags EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_ctrl EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_md_data EVP_MD_CTX_new EVP_MD_CTX_pkey_ctx EVP_MD_CTX_reset EVP_MD_CTX_set_flags EVP_MD_CTX_set_update_fn EVP_MD_CTX_test_flags EVP_MD_CTX_update_fn EVP_MD_block_size EVP_MD_do_all EVP_MD_do_all_sorted EVP_MD_flags EVP_MD_meth_dup EVP_MD_meth_free EVP_MD_meth_get_app_datasize EVP_MD_meth_get_cleanup EVP_MD_meth_get_copy EVP_MD_meth_get_ctrl EVP_MD_meth_get_final EVP_MD_meth_get_flags EVP_MD_meth_get_init EVP_MD_meth_get_input_blocksize EVP_MD_meth_get_result_size EVP_MD_meth_get_update EVP_MD_meth_new EVP_MD_meth_set_app_datasize EVP_MD_meth_set_cleanup EVP_MD_meth_set_copy EVP_MD_meth_set_ctrl EVP_MD_meth_set_final EVP_MD_meth_set_flags EVP_MD_meth_set_init EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size EVP_MD_meth_set_update EVP_MD_pkey_type EVP_MD_size EVP_MD_type EVP_OpenFinal EVP_OpenInit EVP_PBE_CipherInit EVP_PBE_alg_add EVP_PBE_alg_add_type EVP_PBE_cleanup EVP_PBE_find EVP_PBE_get EVP_PBE_scrypt EVP_PKCS82PKEY EVP_PKEY2PKCS8 EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_dup EVP_PKEY_CTX_free EVP_PKEY_CTX_get0_peerkey EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get_app_data EVP_PKEY_CTX_get_cb EVP_PKEY_CTX_get_data EVP_PKEY_CTX_get_keygen_info EVP_PKEY_CTX_get_operation EVP_PKEY_CTX_hex2ctrl EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_set0_keygen_info EVP_PKEY_CTX_set_app_data EVP_PKEY_CTX_set_cb EVP_PKEY_CTX_set_data EVP_PKEY_CTX_str2ctrl EVP_PKEY_add1_attr EVP_PKEY_add1_attr_by_NID EVP_PKEY_add1_attr_by_OBJ EVP_PKEY_add1_attr_by_txt EVP_PKEY_asn1_add0 EVP_PKEY_asn1_add_alias EVP_PKEY_asn1_copy EVP_PKEY_asn1_find EVP_PKEY_asn1_find_str EVP_PKEY_asn1_free EVP_PKEY_asn1_get0 EVP_PKEY_asn1_get0_info EVP_PKEY_asn1_get_count EVP_PKEY_asn1_new EVP_PKEY_asn1_set_ctrl EVP_PKEY_asn1_set_free EVP_PKEY_asn1_set_item EVP_PKEY_asn1_set_param EVP_PKEY_asn1_set_private EVP_PKEY_asn1_set_public EVP_PKEY_asn1_set_security_bits EVP_PKEY_assign EVP_PKEY_base_id EVP_PKEY_bits EVP_PKEY_cmp EVP_PKEY_cmp_parameters EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_decrypt_old EVP_PKEY_delete_attr EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_encrypt_old EVP_PKEY_free EVP_PKEY_get0 EVP_PKEY_get0_DH EVP_PKEY_get0_DSA EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get0_asn1 EVP_PKEY_get0_hmac EVP_PKEY_get1_DH EVP_PKEY_get1_DSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_get1_tls_encodedpoint EVP_PKEY_get_attr EVP_PKEY_get_attr_by_NID EVP_PKEY_get_attr_by_OBJ EVP_PKEY_get_attr_count EVP_PKEY_get_default_digest_nid EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_meth_add0 EVP_PKEY_meth_copy EVP_PKEY_meth_find EVP_PKEY_meth_free EVP_PKEY_meth_get0_info EVP_PKEY_meth_get_cleanup EVP_PKEY_meth_get_copy EVP_PKEY_meth_get_ctrl EVP_PKEY_meth_get_decrypt EVP_PKEY_meth_get_derive EVP_PKEY_meth_get_encrypt EVP_PKEY_meth_get_init EVP_PKEY_meth_get_keygen EVP_PKEY_meth_get_paramgen EVP_PKEY_meth_get_sign EVP_PKEY_meth_get_signctx EVP_PKEY_meth_get_verify EVP_PKEY_meth_get_verify_recover EVP_PKEY_meth_get_verifyctx EVP_PKEY_meth_new EVP_PKEY_meth_set_cleanup EVP_PKEY_meth_set_copy EVP_PKEY_meth_set_ctrl EVP_PKEY_meth_set_decrypt EVP_PKEY_meth_set_derive EVP_PKEY_meth_set_encrypt EVP_PKEY_meth_set_init EVP_PKEY_meth_set_keygen EVP_PKEY_meth_set_paramgen EVP_PKEY_meth_set_sign EVP_PKEY_meth_set_signctx EVP_PKEY_meth_set_verify EVP_PKEY_meth_set_verify_recover EVP_PKEY_meth_set_verifyctx EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_mac_key EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_print_params EVP_PKEY_print_private EVP_PKEY_print_public EVP_PKEY_save_parameters EVP_PKEY_security_bits EVP_PKEY_set1_DH EVP_PKEY_set1_DSA EVP_PKEY_set1_EC_KEY EVP_PKEY_set1_RSA EVP_PKEY_set1_engine EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_set_type EVP_PKEY_set_type_str EVP_PKEY_sign EVP_PKEY_sign_init EVP_PKEY_size EVP_PKEY_type EVP_PKEY_up_ref EVP_PKEY_verify EVP_PKEY_verify_init EVP_PKEY_verify_recover EVP_PKEY_verify_recover_init EVP_SealFinal EVP_SealInit EVP_SignFinal EVP_VerifyFinal EVP_add_alg_module EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_128_ccm EVP_aes_128_cfb1 EVP_aes_128_cfb128 EVP_aes_128_cfb8 EVP_aes_128_ctr EVP_aes_128_ecb EVP_aes_128_gcm EVP_aes_128_ocb EVP_aes_128_ofb EVP_aes_128_wrap EVP_aes_128_wrap_pad EVP_aes_128_xts EVP_aes_192_cbc EVP_aes_192_ccm EVP_aes_192_cfb1 EVP_aes_192_cfb128 EVP_aes_192_cfb8 EVP_aes_192_ctr EVP_aes_192_ecb EVP_aes_192_gcm EVP_aes_192_ocb EVP_aes_192_ofb EVP_aes_192_wrap EVP_aes_192_wrap_pad EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha256 EVP_aes_256_ccm EVP_aes_256_cfb1 EVP_aes_256_cfb128 EVP_aes_256_cfb8 EVP_aes_256_ctr EVP_aes_256_ecb EVP_aes_256_gcm EVP_aes_256_ocb EVP_aes_256_ofb EVP_aes_256_wrap EVP_aes_256_wrap_pad EVP_aes_256_xts EVP_bf_cbc EVP_bf_cfb64 EVP_bf_ecb EVP_bf_ofb EVP_blake2b512 EVP_blake2s256 EVP_camellia_128_cbc EVP_camellia_128_cfb1 EVP_camellia_128_cfb128 EVP_camellia_128_cfb8 EVP_camellia_128_ctr EVP_camellia_128_ecb EVP_camellia_128_ofb EVP_camellia_192_cbc EVP_camellia_192_cfb1 EVP_camellia_192_cfb128 EVP_camellia_192_cfb8 EVP_camellia_192_ctr EVP_camellia_192_ecb EVP_camellia_192_ofb EVP_camellia_256_cbc EVP_camellia_256_cfb1 EVP_camellia_256_cfb128 EVP_camellia_256_cfb8 EVP_camellia_256_ctr EVP_camellia_256_ecb EVP_camellia_256_ofb EVP_cast5_cbc EVP_cast5_cfb64 EVP_cast5_ecb EVP_cast5_ofb EVP_chacha20 EVP_chacha20_poly1305 EVP_des_cbc EVP_des_cfb1 EVP_des_cfb64 EVP_des_cfb8 EVP_des_ecb EVP_des_ede EVP_des_ede3 EVP_des_ede3_cbc EVP_des_ede3_cfb1 EVP_des_ede3_cfb64 EVP_des_ede3_cfb8 EVP_des_ede3_ecb EVP_des_ede3_ofb EVP_des_ede3_wrap EVP_des_ede_cbc EVP_des_ede_cfb64 EVP_des_ede_ecb EVP_des_ede_ofb EVP_des_ofb EVP_desx_cbc EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_get_pw_prompt EVP_idea_cbc EVP_idea_cfb64 EVP_idea_ecb EVP_idea_ofb EVP_md4 EVP_md5 EVP_md5_sha1 EVP_md_null EVP_mdc2 EVP_rc2_40_cbc EVP_rc2_64_cbc EVP_rc2_cbc EVP_rc2_cfb64 EVP_rc2_ecb EVP_rc2_ofb EVP_rc4 EVP_rc4_40 EVP_rc4_hmac_md5 EVP_read_pw_string EVP_read_pw_string_min EVP_ripemd160 EVP_seed_cbc EVP_seed_cfb128 EVP_seed_ecb EVP_seed_ofb EVP_set_pw_prompt EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512 EVP_whirlpool EXTENDED_KEY_USAGE_free EXTENDED_KEY_USAGE_it EXTENDED_KEY_USAGE_new FIPS_mode FIPS_mode_set GENERAL_NAMES_free GENERAL_NAMES_it GENERAL_NAMES_new GENERAL_NAME_cmp GENERAL_NAME_dup GENERAL_NAME_free GENERAL_NAME_get0_otherName GENERAL_NAME_get0_value GENERAL_NAME_it GENERAL_NAME_new GENERAL_NAME_print GENERAL_NAME_set0_othername GENERAL_NAME_set0_value GENERAL_SUBTREE_free GENERAL_SUBTREE_it GENERAL_SUBTREE_new HMAC HMAC_CTX_copy HMAC_CTX_free HMAC_CTX_get_md HMAC_CTX_new HMAC_CTX_reset HMAC_CTX_set_flags HMAC_Final HMAC_Init HMAC_Init_ex HMAC_Update HMAC_size IDEA_cbc_encrypt IDEA_cfb64_encrypt IDEA_ecb_encrypt IDEA_encrypt IDEA_ofb64_encrypt IDEA_options IDEA_set_decrypt_key IDEA_set_encrypt_key INT32_it INT64_it IPAddressChoice_free IPAddressChoice_it IPAddressChoice_new IPAddressFamily_free IPAddressFamily_it IPAddressFamily_new IPAddressOrRange_free IPAddressOrRange_it IPAddressOrRange_new IPAddressRange_free IPAddressRange_it IPAddressRange_new ISSUING_DIST_POINT_free ISSUING_DIST_POINT_it ISSUING_DIST_POINT_new LONG_it MD4 MD4_Final MD4_Init MD4_Transform MD4_Update MD5 MD5_Final MD5_Init MD5_Transform MD5_Update MDC2 MDC2_Final MDC2_Init MDC2_Update NAME_CONSTRAINTS_check NAME_CONSTRAINTS_check_CN NAME_CONSTRAINTS_free NAME_CONSTRAINTS_it NAME_CONSTRAINTS_new NCONF_WIN32 NCONF_default NCONF_dump_bio NCONF_dump_fp NCONF_free NCONF_free_data NCONF_get_number_e NCONF_get_section NCONF_get_string NCONF_load NCONF_load_bio NCONF_load_fp NCONF_new NETSCAPE_CERT_SEQUENCE_free NETSCAPE_CERT_SEQUENCE_it NETSCAPE_CERT_SEQUENCE_new NETSCAPE_SPKAC_free NETSCAPE_SPKAC_it NETSCAPE_SPKAC_new NETSCAPE_SPKI_b64_decode NETSCAPE_SPKI_b64_encode NETSCAPE_SPKI_free NETSCAPE_SPKI_get_pubkey NETSCAPE_SPKI_it NETSCAPE_SPKI_new NETSCAPE_SPKI_print NETSCAPE_SPKI_set_pubkey NETSCAPE_SPKI_sign NETSCAPE_SPKI_verify NOTICEREF_free NOTICEREF_it NOTICEREF_new OBJ_NAME_add OBJ_NAME_cleanup OBJ_NAME_do_all OBJ_NAME_do_all_sorted OBJ_NAME_get OBJ_NAME_init OBJ_NAME_new_index OBJ_NAME_remove OBJ_add_object OBJ_add_sigid OBJ_bsearch_ OBJ_bsearch_ex_ OBJ_cmp OBJ_create OBJ_create_objects OBJ_dup OBJ_find_sigid_algs OBJ_find_sigid_by_algs OBJ_get0_data OBJ_length OBJ_ln2nid OBJ_new_nid OBJ_nid2ln OBJ_nid2obj OBJ_nid2sn OBJ_obj2nid OBJ_obj2txt OBJ_sigid_free OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OCSP_BASICRESP_add1_ext_i2d OCSP_BASICRESP_add_ext OCSP_BASICRESP_delete_ext OCSP_BASICRESP_free OCSP_BASICRESP_get1_ext_d2i OCSP_BASICRESP_get_ext OCSP_BASICRESP_get_ext_by_NID OCSP_BASICRESP_get_ext_by_OBJ OCSP_BASICRESP_get_ext_by_critical OCSP_BASICRESP_get_ext_count OCSP_BASICRESP_it OCSP_BASICRESP_new OCSP_CERTID_dup OCSP_CERTID_free OCSP_CERTID_it OCSP_CERTID_new OCSP_CERTSTATUS_free OCSP_CERTSTATUS_it OCSP_CERTSTATUS_new OCSP_CRLID_free OCSP_CRLID_it OCSP_CRLID_new OCSP_ONEREQ_add1_ext_i2d OCSP_ONEREQ_add_ext OCSP_ONEREQ_delete_ext OCSP_ONEREQ_free OCSP_ONEREQ_get1_ext_d2i OCSP_ONEREQ_get_ext OCSP_ONEREQ_get_ext_by_NID OCSP_ONEREQ_get_ext_by_OBJ OCSP_ONEREQ_get_ext_by_critical OCSP_ONEREQ_get_ext_count OCSP_ONEREQ_it OCSP_ONEREQ_new OCSP_REQINFO_free OCSP_REQINFO_it OCSP_REQINFO_new OCSP_REQUEST_add1_ext_i2d OCSP_REQUEST_add_ext OCSP_REQUEST_delete_ext OCSP_REQUEST_free OCSP_REQUEST_get1_ext_d2i OCSP_REQUEST_get_ext OCSP_REQUEST_get_ext_by_NID OCSP_REQUEST_get_ext_by_OBJ OCSP_REQUEST_get_ext_by_critical OCSP_REQUEST_get_ext_count OCSP_REQUEST_it OCSP_REQUEST_new OCSP_REQUEST_print OCSP_REQ_CTX_add1_header OCSP_REQ_CTX_free OCSP_REQ_CTX_get0_mem_bio OCSP_REQ_CTX_http OCSP_REQ_CTX_i2d OCSP_REQ_CTX_nbio OCSP_REQ_CTX_nbio_d2i OCSP_REQ_CTX_new OCSP_REQ_CTX_set1_req OCSP_RESPBYTES_free OCSP_RESPBYTES_it OCSP_RESPBYTES_new OCSP_RESPDATA_free OCSP_RESPDATA_it OCSP_RESPDATA_new OCSP_RESPID_free OCSP_RESPID_it OCSP_RESPID_match OCSP_RESPID_new OCSP_RESPID_set_by_key OCSP_RESPID_set_by_name OCSP_RESPONSE_free OCSP_RESPONSE_it OCSP_RESPONSE_new OCSP_RESPONSE_print OCSP_REVOKEDINFO_free OCSP_REVOKEDINFO_it OCSP_REVOKEDINFO_new OCSP_SERVICELOC_free OCSP_SERVICELOC_it OCSP_SERVICELOC_new OCSP_SIGNATURE_free OCSP_SIGNATURE_it OCSP_SIGNATURE_new OCSP_SINGLERESP_add1_ext_i2d OCSP_SINGLERESP_add_ext OCSP_SINGLERESP_delete_ext OCSP_SINGLERESP_free OCSP_SINGLERESP_get0_id OCSP_SINGLERESP_get1_ext_d2i OCSP_SINGLERESP_get_ext OCSP_SINGLERESP_get_ext_by_NID OCSP_SINGLERESP_get_ext_by_OBJ OCSP_SINGLERESP_get_ext_by_critical OCSP_SINGLERESP_get_ext_count OCSP_SINGLERESP_it OCSP_SINGLERESP_new OCSP_accept_responses_new OCSP_archive_cutoff_new OCSP_basic_add1_cert OCSP_basic_add1_nonce OCSP_basic_add1_status OCSP_basic_sign OCSP_basic_verify OCSP_cert_id_new OCSP_cert_status_str OCSP_cert_to_id OCSP_check_nonce OCSP_check_validity OCSP_copy_nonce OCSP_crlID_new OCSP_crl_reason_str OCSP_id_cmp OCSP_id_get0_info OCSP_id_issuer_cmp OCSP_onereq_get0_id OCSP_parse_url OCSP_request_add0_id OCSP_request_add1_cert OCSP_request_add1_nonce OCSP_request_is_signed OCSP_request_onereq_count OCSP_request_onereq_get0 OCSP_request_set1_name OCSP_request_sign OCSP_request_verify OCSP_resp_count OCSP_resp_find OCSP_resp_find_status OCSP_resp_get0 OCSP_resp_get0_certs OCSP_resp_get0_id OCSP_resp_get0_produced_at OCSP_resp_get0_signature OCSP_resp_get0_signer OCSP_response_create OCSP_response_get1_basic OCSP_response_status OCSP_response_status_str OCSP_sendreq_bio OCSP_sendreq_nbio OCSP_sendreq_new OCSP_set_max_response_length OCSP_single_get0_status OCSP_url_svcloc_new OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_INIT_free OPENSSL_INIT_new OPENSSL_INIT_set_config_appname OPENSSL_LH_delete OPENSSL_LH_doall OPENSSL_LH_doall_arg OPENSSL_LH_error OPENSSL_LH_free OPENSSL_LH_get_down_load OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_node_stats OPENSSL_LH_node_stats_bio OPENSSL_LH_node_usage_stats OPENSSL_LH_node_usage_stats_bio OPENSSL_LH_num_items OPENSSL_LH_retrieve OPENSSL_LH_set_down_load OPENSSL_LH_stats OPENSSL_LH_stats_bio OPENSSL_LH_strhash OPENSSL_asc2uni OPENSSL_atexit OPENSSL_buf2hexstr OPENSSL_cleanse OPENSSL_cleanup OPENSSL_config OPENSSL_die OPENSSL_gmtime OPENSSL_gmtime_adj OPENSSL_gmtime_diff OPENSSL_hexchar2int OPENSSL_hexstr2buf OPENSSL_init OPENSSL_init_crypto OPENSSL_isservice OPENSSL_issetugid OPENSSL_load_builtin_modules OPENSSL_memcmp OPENSSL_sk_deep_copy OPENSSL_sk_delete OPENSSL_sk_delete_ptr OPENSSL_sk_dup OPENSSL_sk_find OPENSSL_sk_find_ex OPENSSL_sk_free OPENSSL_sk_insert OPENSSL_sk_is_sorted OPENSSL_sk_new OPENSSL_sk_new_null OPENSSL_sk_num OPENSSL_sk_pop OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_set OPENSSL_sk_set_cmp_func OPENSSL_sk_shift OPENSSL_sk_sort OPENSSL_sk_unshift OPENSSL_sk_value OPENSSL_sk_zero OPENSSL_strlcat OPENSSL_strlcpy OPENSSL_strnlen OPENSSL_thread_stop OPENSSL_uni2asc OPENSSL_uni2utf8 OPENSSL_utf82uni OTHERNAME_cmp OTHERNAME_free OTHERNAME_it OTHERNAME_new OpenSSL_version OpenSSL_version_num PBE2PARAM_free PBE2PARAM_it PBE2PARAM_new PBEPARAM_free PBEPARAM_it PBEPARAM_new PBKDF2PARAM_free PBKDF2PARAM_it PBKDF2PARAM_new PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_SignFinal PEM_SignInit PEM_SignUpdate PEM_X509_INFO_read PEM_X509_INFO_read_bio PEM_X509_INFO_write_bio PEM_bytes_read_bio PEM_def_callback PEM_dek_info PEM_do_header PEM_get_EVP_CIPHER_INFO PEM_proc_type PEM_read PEM_read_CMS PEM_read_DHparams PEM_read_DSAPrivateKey PEM_read_DSA_PUBKEY PEM_read_DSAparams PEM_read_ECPKParameters PEM_read_ECPrivateKey PEM_read_EC_PUBKEY PEM_read_NETSCAPE_CERT_SEQUENCE PEM_read_PKCS7 PEM_read_PKCS8 PEM_read_PKCS8_PRIV_KEY_INFO PEM_read_PUBKEY PEM_read_PrivateKey PEM_read_RSAPrivateKey PEM_read_RSAPublicKey PEM_read_RSA_PUBKEY PEM_read_X509 PEM_read_X509_AUX PEM_read_X509_CRL PEM_read_X509_REQ PEM_read_bio PEM_read_bio_CMS PEM_read_bio_DHparams PEM_read_bio_DSAPrivateKey PEM_read_bio_DSA_PUBKEY PEM_read_bio_DSAparams PEM_read_bio_ECPKParameters PEM_read_bio_ECPrivateKey PEM_read_bio_EC_PUBKEY PEM_read_bio_NETSCAPE_CERT_SEQUENCE PEM_read_bio_PKCS7 PEM_read_bio_PKCS8 PEM_read_bio_PKCS8_PRIV_KEY_INFO PEM_read_bio_PUBKEY PEM_read_bio_Parameters PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_RSAPublicKey PEM_read_bio_RSA_PUBKEY PEM_read_bio_X509 PEM_read_bio_X509_AUX PEM_read_bio_X509_CRL PEM_read_bio_X509_REQ PEM_write PEM_write_CMS PEM_write_DHparams PEM_write_DHxparams PEM_write_DSAPrivateKey PEM_write_DSA_PUBKEY PEM_write_DSAparams PEM_write_ECPKParameters PEM_write_ECPrivateKey PEM_write_EC_PUBKEY PEM_write_NETSCAPE_CERT_SEQUENCE PEM_write_PKCS7 PEM_write_PKCS8 PEM_write_PKCS8PrivateKey PEM_write_PKCS8PrivateKey_nid PEM_write_PKCS8_PRIV_KEY_INFO PEM_write_PUBKEY PEM_write_PrivateKey PEM_write_RSAPrivateKey PEM_write_RSAPublicKey PEM_write_RSA_PUBKEY PEM_write_X509 PEM_write_X509_AUX PEM_write_X509_CRL PEM_write_X509_REQ PEM_write_X509_REQ_NEW PEM_write_bio PEM_write_bio_ASN1_stream PEM_write_bio_CMS PEM_write_bio_CMS_stream PEM_write_bio_DHparams PEM_write_bio_DHxparams PEM_write_bio_DSAPrivateKey PEM_write_bio_DSA_PUBKEY PEM_write_bio_DSAparams PEM_write_bio_ECPKParameters PEM_write_bio_ECPrivateKey PEM_write_bio_EC_PUBKEY PEM_write_bio_NETSCAPE_CERT_SEQUENCE PEM_write_bio_PKCS7 PEM_write_bio_PKCS7_stream PEM_write_bio_PKCS8 PEM_write_bio_PKCS8PrivateKey PEM_write_bio_PKCS8PrivateKey_nid PEM_write_bio_PKCS8_PRIV_KEY_INFO PEM_write_bio_PUBKEY PEM_write_bio_Parameters PEM_write_bio_PrivateKey PEM_write_bio_PrivateKey_traditional PEM_write_bio_RSAPrivateKey PEM_write_bio_RSAPublicKey PEM_write_bio_RSA_PUBKEY PEM_write_bio_X509 PEM_write_bio_X509_AUX PEM_write_bio_X509_CRL PEM_write_bio_X509_REQ PEM_write_bio_X509_REQ_NEW PKCS12_AUTHSAFES_it PKCS12_BAGS_free PKCS12_BAGS_it PKCS12_BAGS_new PKCS12_MAC_DATA_free PKCS12_MAC_DATA_it PKCS12_MAC_DATA_new PKCS12_PBE_add PKCS12_PBE_keyivgen PKCS12_SAFEBAGS_it PKCS12_SAFEBAG_create0_p8inf PKCS12_SAFEBAG_create0_pkcs8 PKCS12_SAFEBAG_create_cert PKCS12_SAFEBAG_create_crl PKCS12_SAFEBAG_create_pkcs8_encrypt PKCS12_SAFEBAG_free PKCS12_SAFEBAG_get0_attr PKCS12_SAFEBAG_get0_attrs PKCS12_SAFEBAG_get0_p8inf PKCS12_SAFEBAG_get0_pkcs8 PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_type PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get1_crl PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_it PKCS12_SAFEBAG_new PKCS12_add_CSPName_asc PKCS12_add_cert PKCS12_add_friendlyname_asc PKCS12_add_friendlyname_uni PKCS12_add_friendlyname_utf8 PKCS12_add_key PKCS12_add_localkeyid PKCS12_add_safe PKCS12_add_safes PKCS12_create PKCS12_decrypt_skey PKCS12_free PKCS12_gen_mac PKCS12_get0_mac PKCS12_get_attr PKCS12_get_attr_gen PKCS12_get_friendlyname PKCS12_init PKCS12_it PKCS12_item_decrypt_d2i PKCS12_item_i2d_encrypt PKCS12_item_pack_safebag PKCS12_key_gen_asc PKCS12_key_gen_uni PKCS12_key_gen_utf8 PKCS12_mac_present PKCS12_new PKCS12_newpass PKCS12_pack_authsafes PKCS12_pack_p7data PKCS12_pack_p7encdata PKCS12_parse PKCS12_pbe_crypt PKCS12_set_mac PKCS12_setup_mac PKCS12_unpack_authsafes PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_verify_mac PKCS1_MGF1 PKCS5_PBE_add PKCS5_PBE_keyivgen PKCS5_PBKDF2_HMAC PKCS5_PBKDF2_HMAC_SHA1 PKCS5_pbe2_set PKCS5_pbe2_set_iv PKCS5_pbe2_set_scrypt PKCS5_pbe_set PKCS5_pbe_set0_algor PKCS5_pbkdf2_set PKCS5_v2_PBE_keyivgen PKCS5_v2_scrypt_keyivgen PKCS7_ATTR_SIGN_it PKCS7_ATTR_VERIFY_it PKCS7_DIGEST_free PKCS7_DIGEST_it PKCS7_DIGEST_new PKCS7_ENCRYPT_free PKCS7_ENCRYPT_it PKCS7_ENCRYPT_new PKCS7_ENC_CONTENT_free PKCS7_ENC_CONTENT_it PKCS7_ENC_CONTENT_new PKCS7_ENVELOPE_free PKCS7_ENVELOPE_it PKCS7_ENVELOPE_new PKCS7_ISSUER_AND_SERIAL_digest PKCS7_ISSUER_AND_SERIAL_free PKCS7_ISSUER_AND_SERIAL_it PKCS7_ISSUER_AND_SERIAL_new PKCS7_RECIP_INFO_free PKCS7_RECIP_INFO_get0_alg PKCS7_RECIP_INFO_it PKCS7_RECIP_INFO_new PKCS7_RECIP_INFO_set PKCS7_SIGNED_free PKCS7_SIGNED_it PKCS7_SIGNED_new PKCS7_SIGNER_INFO_free PKCS7_SIGNER_INFO_get0_algs PKCS7_SIGNER_INFO_it PKCS7_SIGNER_INFO_new PKCS7_SIGNER_INFO_set PKCS7_SIGNER_INFO_sign PKCS7_SIGN_ENVELOPE_free PKCS7_SIGN_ENVELOPE_it PKCS7_SIGN_ENVELOPE_new PKCS7_add0_attrib_signing_time PKCS7_add1_attrib_digest PKCS7_add_attrib_content_type PKCS7_add_attrib_smimecap PKCS7_add_attribute PKCS7_add_certificate PKCS7_add_crl PKCS7_add_recipient PKCS7_add_recipient_info PKCS7_add_signature PKCS7_add_signed_attribute PKCS7_add_signer PKCS7_cert_from_signer_info PKCS7_content_new PKCS7_ctrl PKCS7_dataDecode PKCS7_dataFinal PKCS7_dataInit PKCS7_dataVerify PKCS7_decrypt PKCS7_digest_from_attributes PKCS7_dup PKCS7_encrypt PKCS7_final PKCS7_free PKCS7_get0_signers PKCS7_get_attribute PKCS7_get_issuer_and_serial PKCS7_get_signed_attribute PKCS7_get_signer_info PKCS7_get_smimecap PKCS7_it PKCS7_new PKCS7_print_ctx PKCS7_set0_type_other PKCS7_set_attributes PKCS7_set_cipher PKCS7_set_content PKCS7_set_digest PKCS7_set_signed_attributes PKCS7_set_type PKCS7_sign PKCS7_sign_add_signer PKCS7_signatureVerify PKCS7_simple_smimecap PKCS7_stream PKCS7_to_TS_TST_INFO PKCS7_verify PKCS8_PRIV_KEY_INFO_free PKCS8_PRIV_KEY_INFO_it PKCS8_PRIV_KEY_INFO_new PKCS8_add_keyusage PKCS8_decrypt PKCS8_encrypt PKCS8_get_attr PKCS8_pkey_add1_attr_by_NID PKCS8_pkey_get0 PKCS8_pkey_get0_attrs PKCS8_pkey_set0 PKCS8_set0_pbe PKEY_USAGE_PERIOD_free PKEY_USAGE_PERIOD_it PKEY_USAGE_PERIOD_new POLICYINFO_free POLICYINFO_it POLICYINFO_new POLICYQUALINFO_free POLICYQUALINFO_it POLICYQUALINFO_new POLICY_CONSTRAINTS_free POLICY_CONSTRAINTS_it POLICY_CONSTRAINTS_new POLICY_MAPPINGS_it POLICY_MAPPING_free POLICY_MAPPING_it POLICY_MAPPING_new PROXY_CERT_INFO_EXTENSION_free PROXY_CERT_INFO_EXTENSION_it PROXY_CERT_INFO_EXTENSION_new PROXY_POLICY_free PROXY_POLICY_it PROXY_POLICY_new RAND_OpenSSL RAND_add RAND_bytes RAND_event RAND_file_name RAND_get_rand_method RAND_load_file RAND_poll RAND_pseudo_bytes RAND_screen RAND_seed RAND_set_rand_engine RAND_set_rand_method RAND_status RAND_write_file RC2_cbc_encrypt RC2_cfb64_encrypt RC2_decrypt RC2_ecb_encrypt RC2_encrypt RC2_ofb64_encrypt RC2_set_key RC4 RC4_options RC4_set_key RIPEMD160 RIPEMD160_Final RIPEMD160_Init RIPEMD160_Transform RIPEMD160_Update RSAPrivateKey_dup RSAPrivateKey_it RSAPublicKey_dup RSAPublicKey_it RSA_OAEP_PARAMS_free RSA_OAEP_PARAMS_it RSA_OAEP_PARAMS_new RSA_PKCS1_OpenSSL RSA_PSS_PARAMS_free RSA_PSS_PARAMS_it RSA_PSS_PARAMS_new RSA_X931_derive_ex RSA_X931_generate_key_ex RSA_X931_hash_id RSA_bits RSA_blinding_off RSA_blinding_on RSA_check_key RSA_check_key_ex RSA_clear_flags RSA_flags RSA_free RSA_generate_key RSA_generate_key_ex RSA_get0_crt_params RSA_get0_engine RSA_get0_factors RSA_get0_key RSA_get_default_method RSA_get_ex_data RSA_get_method RSA_meth_dup RSA_meth_free RSA_meth_get0_app_data RSA_meth_get0_name RSA_meth_get_bn_mod_exp RSA_meth_get_finish RSA_meth_get_flags RSA_meth_get_init RSA_meth_get_keygen RSA_meth_get_mod_exp RSA_meth_get_priv_dec RSA_meth_get_priv_enc RSA_meth_get_pub_dec RSA_meth_get_pub_enc RSA_meth_get_sign RSA_meth_get_verify RSA_meth_new RSA_meth_set0_app_data RSA_meth_set1_name RSA_meth_set_bn_mod_exp RSA_meth_set_finish RSA_meth_set_flags RSA_meth_set_init RSA_meth_set_keygen RSA_meth_set_mod_exp RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_meth_set_pub_dec RSA_meth_set_pub_enc RSA_meth_set_sign RSA_meth_set_verify RSA_new RSA_new_method RSA_null_method RSA_padding_add_PKCS1_OAEP RSA_padding_add_PKCS1_OAEP_mgf1 RSA_padding_add_PKCS1_PSS RSA_padding_add_PKCS1_PSS_mgf1 RSA_padding_add_PKCS1_type_1 RSA_padding_add_PKCS1_type_2 RSA_padding_add_SSLv23 RSA_padding_add_X931 RSA_padding_add_none RSA_padding_check_PKCS1_OAEP RSA_padding_check_PKCS1_OAEP_mgf1 RSA_padding_check_PKCS1_type_1 RSA_padding_check_PKCS1_type_2 RSA_padding_check_SSLv23 RSA_padding_check_X931 RSA_padding_check_none RSA_print RSA_print_fp RSA_private_decrypt RSA_private_encrypt RSA_public_decrypt RSA_public_encrypt RSA_security_bits RSA_set0_crt_params RSA_set0_factors RSA_set0_key RSA_set_default_method RSA_set_ex_data RSA_set_flags RSA_set_method RSA_setup_blinding RSA_sign RSA_sign_ASN1_OCTET_STRING RSA_size RSA_test_flags RSA_up_ref RSA_verify RSA_verify_ASN1_OCTET_STRING RSA_verify_PKCS1_PSS RSA_verify_PKCS1_PSS_mgf1 SCT_LIST_free SCT_LIST_print SCT_LIST_validate SCT_free SCT_get0_extensions SCT_get0_log_id SCT_get0_signature SCT_get_log_entry_type SCT_get_signature_nid SCT_get_source SCT_get_timestamp SCT_get_validation_status SCT_get_version SCT_new SCT_new_from_base64 SCT_print SCT_set0_extensions SCT_set0_log_id SCT_set0_signature SCT_set1_extensions SCT_set1_log_id SCT_set1_signature SCT_set_log_entry_type SCT_set_signature_nid SCT_set_source SCT_set_timestamp SCT_set_version SCT_validate SCT_validation_status_string SEED_cbc_encrypt SEED_cfb128_encrypt SEED_decrypt SEED_ecb_encrypt SEED_encrypt SEED_ofb128_encrypt SEED_set_key SHA1 SHA1_Final SHA1_Init SHA1_Transform SHA1_Update SHA224 SHA224_Final SHA224_Init SHA224_Update SHA256 SHA256_Final SHA256_Init SHA256_Transform SHA256_Update SHA384 SHA384_Final SHA384_Init SHA384_Update SHA512 SHA512_Final SHA512_Init SHA512_Transform SHA512_Update SMIME_crlf_copy SMIME_read_ASN1 SMIME_read_CMS SMIME_read_PKCS7 SMIME_text SMIME_write_ASN1 SMIME_write_CMS SMIME_write_PKCS7 SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_VBASE_free SRP_VBASE_get1_by_user SRP_VBASE_get_by_user SRP_VBASE_init SRP_VBASE_new SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier SRP_create_verifier_BN SRP_get_default_gN SRP_user_pwd_free SXNETID_free SXNETID_it SXNETID_new SXNET_add_id_INTEGER SXNET_add_id_asc SXNET_add_id_ulong SXNET_free SXNET_get_id_INTEGER SXNET_get_id_asc SXNET_get_id_ulong SXNET_it SXNET_new TLS_FEATURE_free TLS_FEATURE_new TS_ACCURACY_dup TS_ACCURACY_free TS_ACCURACY_get_micros TS_ACCURACY_get_millis TS_ACCURACY_get_seconds TS_ACCURACY_new TS_ACCURACY_set_micros TS_ACCURACY_set_millis TS_ACCURACY_set_seconds TS_ASN1_INTEGER_print_bio TS_CONF_get_tsa_section TS_CONF_load_cert TS_CONF_load_certs TS_CONF_load_key TS_CONF_set_accuracy TS_CONF_set_certs TS_CONF_set_clock_precision_digits TS_CONF_set_crypto_device TS_CONF_set_def_policy TS_CONF_set_default_engine TS_CONF_set_digests TS_CONF_set_ess_cert_id_chain TS_CONF_set_ordering TS_CONF_set_policies TS_CONF_set_serial TS_CONF_set_signer_cert TS_CONF_set_signer_digest TS_CONF_set_signer_key TS_CONF_set_tsa_name TS_MSG_IMPRINT_dup TS_MSG_IMPRINT_free TS_MSG_IMPRINT_get_algo TS_MSG_IMPRINT_get_msg TS_MSG_IMPRINT_new TS_MSG_IMPRINT_print_bio TS_MSG_IMPRINT_set_algo TS_MSG_IMPRINT_set_msg TS_OBJ_print_bio TS_REQ_add_ext TS_REQ_delete_ext TS_REQ_dup TS_REQ_ext_free TS_REQ_free TS_REQ_get_cert_req TS_REQ_get_ext TS_REQ_get_ext_by_NID TS_REQ_get_ext_by_OBJ TS_REQ_get_ext_by_critical TS_REQ_get_ext_count TS_REQ_get_ext_d2i TS_REQ_get_exts TS_REQ_get_msg_imprint TS_REQ_get_nonce TS_REQ_get_policy_id TS_REQ_get_version TS_REQ_new TS_REQ_print_bio TS_REQ_set_cert_req TS_REQ_set_msg_imprint TS_REQ_set_nonce TS_REQ_set_policy_id TS_REQ_set_version TS_REQ_to_TS_VERIFY_CTX TS_RESP_CTX_add_failure_info TS_RESP_CTX_add_flags TS_RESP_CTX_add_md TS_RESP_CTX_add_policy TS_RESP_CTX_free TS_RESP_CTX_get_request TS_RESP_CTX_get_tst_info TS_RESP_CTX_new TS_RESP_CTX_set_accuracy TS_RESP_CTX_set_certs TS_RESP_CTX_set_clock_precision_digits TS_RESP_CTX_set_def_policy TS_RESP_CTX_set_extension_cb TS_RESP_CTX_set_serial_cb TS_RESP_CTX_set_signer_cert TS_RESP_CTX_set_signer_digest TS_RESP_CTX_set_signer_key TS_RESP_CTX_set_status_info TS_RESP_CTX_set_status_info_cond TS_RESP_CTX_set_time_cb TS_RESP_create_response TS_RESP_dup TS_RESP_free TS_RESP_get_status_info TS_RESP_get_token TS_RESP_get_tst_info TS_RESP_new TS_RESP_print_bio TS_RESP_set_status_info TS_RESP_set_tst_info TS_RESP_verify_response TS_RESP_verify_signature TS_RESP_verify_token TS_STATUS_INFO_dup TS_STATUS_INFO_free TS_STATUS_INFO_get0_failure_info TS_STATUS_INFO_get0_status TS_STATUS_INFO_get0_text TS_STATUS_INFO_new TS_STATUS_INFO_print_bio TS_STATUS_INFO_set_status TS_TST_INFO_add_ext TS_TST_INFO_delete_ext TS_TST_INFO_dup TS_TST_INFO_ext_free TS_TST_INFO_free TS_TST_INFO_get_accuracy TS_TST_INFO_get_ext TS_TST_INFO_get_ext_by_NID TS_TST_INFO_get_ext_by_OBJ TS_TST_INFO_get_ext_by_critical TS_TST_INFO_get_ext_count TS_TST_INFO_get_ext_d2i TS_TST_INFO_get_exts TS_TST_INFO_get_msg_imprint TS_TST_INFO_get_nonce TS_TST_INFO_get_ordering TS_TST_INFO_get_policy_id TS_TST_INFO_get_serial TS_TST_INFO_get_time TS_TST_INFO_get_tsa TS_TST_INFO_get_version TS_TST_INFO_new TS_TST_INFO_print_bio TS_TST_INFO_set_accuracy TS_TST_INFO_set_msg_imprint TS_TST_INFO_set_nonce TS_TST_INFO_set_ordering TS_TST_INFO_set_policy_id TS_TST_INFO_set_serial TS_TST_INFO_set_time TS_TST_INFO_set_tsa TS_TST_INFO_set_version TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_add_flags TS_VERIFY_CTX_cleanup TS_VERIFY_CTX_free TS_VERIFY_CTX_init TS_VERIFY_CTX_new TS_VERIFY_CTX_set_data TS_VERIFY_CTX_set_flags TS_VERIFY_CTX_set_imprint TS_VERIFY_CTX_set_store TS_X509_ALGOR_print_bio TS_ext_print_bio TXT_DB_create_index TXT_DB_free TXT_DB_get_by_index TXT_DB_insert TXT_DB_read TXT_DB_write UINT32_it UINT64_it UI_OpenSSL UI_UTIL_read_pw UI_UTIL_read_pw_string UI_add_error_string UI_add_info_string UI_add_input_boolean UI_add_input_string UI_add_user_data UI_add_verify_string UI_construct_prompt UI_create_method UI_ctrl UI_destroy_method UI_dup_error_string UI_dup_info_string UI_dup_input_boolean UI_dup_input_string UI_dup_verify_string UI_free UI_get0_action_string UI_get0_output_string UI_get0_result UI_get0_result_string UI_get0_test_string UI_get0_user_data UI_get_default_method UI_get_ex_data UI_get_input_flags UI_get_method UI_get_result_maxsize UI_get_result_minsize UI_get_string_type UI_method_get_closer UI_method_get_flusher UI_method_get_opener UI_method_get_prompt_constructor UI_method_get_reader UI_method_get_writer UI_method_set_closer UI_method_set_flusher UI_method_set_opener UI_method_set_prompt_constructor UI_method_set_reader UI_method_set_writer UI_new UI_new_method UI_process UI_set_default_method UI_set_ex_data UI_set_method UI_set_result USERNOTICE_free USERNOTICE_it USERNOTICE_new UTF8_getc UTF8_putc WHIRLPOOL WHIRLPOOL_BitUpdate WHIRLPOOL_Final WHIRLPOOL_Init WHIRLPOOL_Update X509V3_EXT_CRL_add_conf X509V3_EXT_CRL_add_nconf X509V3_EXT_REQ_add_conf X509V3_EXT_REQ_add_nconf X509V3_EXT_add X509V3_EXT_add_alias X509V3_EXT_add_conf X509V3_EXT_add_list X509V3_EXT_add_nconf X509V3_EXT_add_nconf_sk X509V3_EXT_cleanup X509V3_EXT_conf X509V3_EXT_conf_nid X509V3_EXT_d2i X509V3_EXT_get X509V3_EXT_get_nid X509V3_EXT_i2d X509V3_EXT_nconf X509V3_EXT_nconf_nid X509V3_EXT_print X509V3_EXT_print_fp X509V3_EXT_val_prn X509V3_NAME_from_section X509V3_add1_i2d X509V3_add_standard_extensions X509V3_add_value X509V3_add_value_bool X509V3_add_value_bool_nf X509V3_add_value_int X509V3_add_value_uchar X509V3_conf_free X509V3_extensions_print X509V3_get_d2i X509V3_get_section X509V3_get_string X509V3_get_value_bool X509V3_get_value_int X509V3_parse_list X509V3_section_free X509V3_set_conf_lhash X509V3_set_ctx X509V3_set_nconf X509V3_string_free X509_ALGORS_it X509_ALGOR_cmp X509_ALGOR_dup X509_ALGOR_free X509_ALGOR_get0 X509_ALGOR_it X509_ALGOR_new X509_ALGOR_set0 X509_ALGOR_set_md X509_ATTRIBUTE_count X509_ATTRIBUTE_create X509_ATTRIBUTE_create_by_NID X509_ATTRIBUTE_create_by_OBJ X509_ATTRIBUTE_create_by_txt X509_ATTRIBUTE_dup X509_ATTRIBUTE_free X509_ATTRIBUTE_get0_data X509_ATTRIBUTE_get0_object X509_ATTRIBUTE_get0_type X509_ATTRIBUTE_it X509_ATTRIBUTE_new X509_ATTRIBUTE_set1_data X509_ATTRIBUTE_set1_object X509_CERT_AUX_free X509_CERT_AUX_it X509_CERT_AUX_new X509_CINF_free X509_CINF_it X509_CINF_new X509_CRL_INFO_free X509_CRL_INFO_it X509_CRL_INFO_new X509_CRL_METHOD_free X509_CRL_METHOD_new X509_CRL_add0_revoked X509_CRL_add1_ext_i2d X509_CRL_add_ext X509_CRL_check_suiteb X509_CRL_cmp X509_CRL_delete_ext X509_CRL_diff X509_CRL_digest X509_CRL_dup X509_CRL_free X509_CRL_get0_by_cert X509_CRL_get0_by_serial X509_CRL_get0_extensions X509_CRL_get0_lastUpdate X509_CRL_get0_nextUpdate X509_CRL_get0_signature X509_CRL_get_REVOKED X509_CRL_get_ext X509_CRL_get_ext_by_NID X509_CRL_get_ext_by_OBJ X509_CRL_get_ext_by_critical X509_CRL_get_ext_count X509_CRL_get_ext_d2i X509_CRL_get_issuer X509_CRL_get_lastUpdate X509_CRL_get_meth_data X509_CRL_get_nextUpdate X509_CRL_get_signature_nid X509_CRL_get_version X509_CRL_http_nbio X509_CRL_it X509_CRL_match X509_CRL_new X509_CRL_print X509_CRL_print_fp X509_CRL_set1_lastUpdate X509_CRL_set1_nextUpdate X509_CRL_set_default_method X509_CRL_set_issuer_name X509_CRL_set_meth_data X509_CRL_set_version X509_CRL_sign X509_CRL_sign_ctx X509_CRL_sort X509_CRL_up_ref X509_CRL_verify X509_EXTENSIONS_it X509_EXTENSION_create_by_NID X509_EXTENSION_create_by_OBJ X509_EXTENSION_dup X509_EXTENSION_free X509_EXTENSION_get_critical X509_EXTENSION_get_data X509_EXTENSION_get_object X509_EXTENSION_it X509_EXTENSION_new X509_EXTENSION_set_critical X509_EXTENSION_set_data X509_EXTENSION_set_object X509_INFO_free X509_INFO_new X509_LOOKUP_by_alias X509_LOOKUP_by_fingerprint X509_LOOKUP_by_issuer_serial X509_LOOKUP_by_subject X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_free X509_LOOKUP_hash_dir X509_LOOKUP_init X509_LOOKUP_new X509_LOOKUP_shutdown X509_NAME_ENTRY_create_by_NID X509_NAME_ENTRY_create_by_OBJ X509_NAME_ENTRY_create_by_txt X509_NAME_ENTRY_dup X509_NAME_ENTRY_free X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_ENTRY_it X509_NAME_ENTRY_new X509_NAME_ENTRY_set X509_NAME_ENTRY_set_data X509_NAME_ENTRY_set_object X509_NAME_add_entry X509_NAME_add_entry_by_NID X509_NAME_add_entry_by_OBJ X509_NAME_add_entry_by_txt X509_NAME_cmp X509_NAME_delete_entry X509_NAME_digest X509_NAME_dup X509_NAME_entry_count X509_NAME_free X509_NAME_get0_der X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_get_text_by_NID X509_NAME_get_text_by_OBJ X509_NAME_hash X509_NAME_hash_old X509_NAME_it X509_NAME_new X509_NAME_oneline X509_NAME_print X509_NAME_print_ex X509_NAME_print_ex_fp X509_NAME_set X509_OBJECT_free X509_OBJECT_get0_X509 X509_OBJECT_get0_X509_CRL X509_OBJECT_get_type X509_OBJECT_idx_by_subject X509_OBJECT_new X509_OBJECT_retrieve_by_subject X509_OBJECT_retrieve_match X509_OBJECT_up_ref_count X509_PKEY_free X509_PKEY_new X509_POLICY_NODE_print X509_PUBKEY_free X509_PUBKEY_get X509_PUBKEY_get0 X509_PUBKEY_get0_param X509_PUBKEY_it X509_PUBKEY_new X509_PUBKEY_set X509_PUBKEY_set0_param X509_PURPOSE_add X509_PURPOSE_cleanup X509_PURPOSE_get0 X509_PURPOSE_get0_name X509_PURPOSE_get0_sname X509_PURPOSE_get_by_id X509_PURPOSE_get_by_sname X509_PURPOSE_get_count X509_PURPOSE_get_id X509_PURPOSE_get_trust X509_PURPOSE_set X509_REQ_INFO_free X509_REQ_INFO_it X509_REQ_INFO_new X509_REQ_add1_attr X509_REQ_add1_attr_by_NID X509_REQ_add1_attr_by_OBJ X509_REQ_add1_attr_by_txt X509_REQ_add_extensions X509_REQ_add_extensions_nid X509_REQ_check_private_key X509_REQ_delete_attr X509_REQ_digest X509_REQ_dup X509_REQ_extension_nid X509_REQ_free X509_REQ_get0_pubkey X509_REQ_get0_signature X509_REQ_get1_email X509_REQ_get_X509_PUBKEY X509_REQ_get_attr X509_REQ_get_attr_by_NID X509_REQ_get_attr_by_OBJ X509_REQ_get_attr_count X509_REQ_get_extension_nids X509_REQ_get_extensions X509_REQ_get_pubkey X509_REQ_get_signature_nid X509_REQ_get_subject_name X509_REQ_get_version X509_REQ_it X509_REQ_new X509_REQ_print X509_REQ_print_ex X509_REQ_print_fp X509_REQ_set_extension_nids X509_REQ_set_pubkey X509_REQ_set_subject_name X509_REQ_set_version X509_REQ_sign X509_REQ_sign_ctx X509_REQ_to_X509 X509_REQ_verify X509_REVOKED_add1_ext_i2d X509_REVOKED_add_ext X509_REVOKED_delete_ext X509_REVOKED_dup X509_REVOKED_free X509_REVOKED_get0_extensions X509_REVOKED_get0_revocationDate X509_REVOKED_get0_serialNumber X509_REVOKED_get_ext X509_REVOKED_get_ext_by_NID X509_REVOKED_get_ext_by_OBJ X509_REVOKED_get_ext_by_critical X509_REVOKED_get_ext_count X509_REVOKED_get_ext_d2i X509_REVOKED_it X509_REVOKED_new X509_REVOKED_set_revocationDate X509_REVOKED_set_serialNumber X509_SIG_free X509_SIG_get0 X509_SIG_getm X509_SIG_it X509_SIG_new X509_STORE_CTX_cleanup X509_STORE_CTX_free X509_STORE_CTX_get0_cert X509_STORE_CTX_get0_chain X509_STORE_CTX_get0_current_crl X509_STORE_CTX_get0_current_issuer X509_STORE_CTX_get0_param X509_STORE_CTX_get0_parent_ctx X509_STORE_CTX_get0_policy_tree X509_STORE_CTX_get0_store X509_STORE_CTX_get0_untrusted X509_STORE_CTX_get1_certs X509_STORE_CTX_get1_chain X509_STORE_CTX_get1_crls X509_STORE_CTX_get1_issuer X509_STORE_CTX_get_by_subject X509_STORE_CTX_get_cert_crl X509_STORE_CTX_get_check_crl X509_STORE_CTX_get_check_issued X509_STORE_CTX_get_check_policy X509_STORE_CTX_get_check_revocation X509_STORE_CTX_get_cleanup X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_ex_data X509_STORE_CTX_get_explicit_policy X509_STORE_CTX_get_get_crl X509_STORE_CTX_get_get_issuer X509_STORE_CTX_get_lookup_certs X509_STORE_CTX_get_lookup_crls X509_STORE_CTX_get_num_untrusted X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_get_verify X509_STORE_CTX_get_verify_cb X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_purpose_inherit X509_STORE_CTX_set0_crls X509_STORE_CTX_set0_dane X509_STORE_CTX_set0_param X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_set0_untrusted X509_STORE_CTX_set0_verified_chain X509_STORE_CTX_set_cert X509_STORE_CTX_set_current_cert X509_STORE_CTX_set_default X509_STORE_CTX_set_depth X509_STORE_CTX_set_error X509_STORE_CTX_set_error_depth X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_flags X509_STORE_CTX_set_purpose X509_STORE_CTX_set_time X509_STORE_CTX_set_trust X509_STORE_CTX_set_verify X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_free X509_STORE_get0_objects X509_STORE_get0_param X509_STORE_get_cert_crl X509_STORE_get_check_crl X509_STORE_get_check_issued X509_STORE_get_check_policy X509_STORE_get_check_revocation X509_STORE_get_cleanup X509_STORE_get_ex_data X509_STORE_get_get_crl X509_STORE_get_get_issuer X509_STORE_get_lookup_certs X509_STORE_get_lookup_crls X509_STORE_get_verify X509_STORE_get_verify_cb X509_STORE_load_locations X509_STORE_lock X509_STORE_new X509_STORE_set1_param X509_STORE_set_cert_crl X509_STORE_set_check_crl X509_STORE_set_check_issued X509_STORE_set_check_policy X509_STORE_set_check_revocation X509_STORE_set_cleanup X509_STORE_set_default_paths X509_STORE_set_depth X509_STORE_set_ex_data X509_STORE_set_flags X509_STORE_set_get_crl X509_STORE_set_get_issuer X509_STORE_set_lookup_certs X509_STORE_set_lookup_crls X509_STORE_set_purpose X509_STORE_set_trust X509_STORE_set_verify X509_STORE_set_verify_cb X509_STORE_unlock X509_STORE_up_ref X509_TRUST_add X509_TRUST_cleanup X509_TRUST_get0 X509_TRUST_get0_name X509_TRUST_get_by_id X509_TRUST_get_count X509_TRUST_get_flags X509_TRUST_get_trust X509_TRUST_set X509_TRUST_set_default X509_VAL_free X509_VAL_it X509_VAL_new X509_VERIFY_PARAM_add0_policy X509_VERIFY_PARAM_add0_table X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_clear_flags X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0 X509_VERIFY_PARAM_get0_name X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_auth_level X509_VERIFY_PARAM_get_count X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_get_flags X509_VERIFY_PARAM_get_inh_flags X509_VERIFY_PARAM_get_time X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_lookup X509_VERIFY_PARAM_move_peername X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_email X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set1_ip X509_VERIFY_PARAM_set1_ip_asc X509_VERIFY_PARAM_set1_name X509_VERIFY_PARAM_set1_policies X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_flags X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_set_inh_flags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_time X509_VERIFY_PARAM_set_trust X509_VERIFY_PARAM_table_cleanup X509_add1_ext_i2d X509_add1_reject_object X509_add1_trust_object X509_add_ext X509_alias_get0 X509_alias_set1 X509_aux_print X509_certificate_type X509_chain_check_suiteb X509_chain_up_ref X509_check_akid X509_check_ca X509_check_email X509_check_host X509_check_ip X509_check_ip_asc X509_check_issued X509_check_private_key X509_check_purpose X509_check_trust X509_cmp X509_cmp_current_time X509_cmp_time X509_delete_ext X509_digest X509_dup X509_email_free X509_find_by_issuer_and_serial X509_find_by_subject X509_free X509_get0_authority_key_id X509_get0_extensions X509_get0_notAfter X509_get0_notBefore X509_get0_pubkey X509_get0_pubkey_bitstr X509_get0_reject_objects X509_get0_serialNumber X509_get0_signature X509_get0_subject_key_id X509_get0_tbs_sigalg X509_get0_trust_objects X509_get0_uids X509_get1_email X509_get1_ocsp X509_get_X509_PUBKEY X509_get_default_cert_area X509_get_default_cert_dir X509_get_default_cert_dir_env X509_get_default_cert_file X509_get_default_cert_file_env X509_get_default_private_dir X509_get_ex_data X509_get_ext X509_get_ext_by_NID X509_get_ext_by_OBJ X509_get_ext_by_critical X509_get_ext_count X509_get_ext_d2i X509_get_extended_key_usage X509_get_extension_flags X509_get_issuer_name X509_get_key_usage X509_get_pathlen X509_get_proxy_pathlen X509_get_pubkey X509_get_pubkey_parameters X509_get_serialNumber X509_get_signature_nid X509_get_signature_type X509_get_subject_name X509_get_version X509_getm_notAfter X509_getm_notBefore X509_gmtime_adj X509_http_nbio X509_issuer_and_serial_cmp X509_issuer_and_serial_hash X509_issuer_name_cmp X509_issuer_name_hash X509_issuer_name_hash_old X509_it X509_keyid_get0 X509_keyid_set1 X509_load_cert_crl_file X509_load_cert_file X509_load_crl_file X509_new X509_ocspid_print X509_policy_check X509_policy_level_get0_node X509_policy_level_node_count X509_policy_node_get0_parent X509_policy_node_get0_policy X509_policy_node_get0_qualifiers X509_policy_tree_free X509_policy_tree_get0_level X509_policy_tree_get0_policies X509_policy_tree_get0_user_policies X509_policy_tree_level_count X509_print X509_print_ex X509_print_ex_fp X509_print_fp X509_pubkey_digest X509_reject_clear X509_set1_notAfter X509_set1_notBefore X509_set_ex_data X509_set_issuer_name X509_set_proxy_flag X509_set_proxy_pathlen X509_set_pubkey X509_set_serialNumber X509_set_subject_name X509_set_version X509_sign X509_sign_ctx X509_signature_dump X509_signature_print X509_subject_name_cmp X509_subject_name_hash X509_subject_name_hash_old X509_supported_extension X509_time_adj X509_time_adj_ex X509_to_X509_REQ X509_trust_clear X509_trusted X509_up_ref X509_verify X509_verify_cert X509_verify_cert_error_string X509at_add1_attr X509at_add1_attr_by_NID X509at_add1_attr_by_OBJ X509at_add1_attr_by_txt X509at_delete_attr X509at_get0_data_by_OBJ X509at_get_attr X509at_get_attr_by_NID X509at_get_attr_by_OBJ X509at_get_attr_count X509v3_add_ext X509v3_addr_add_inherit X509v3_addr_add_prefix X509v3_addr_add_range X509v3_addr_canonize X509v3_addr_get_afi X509v3_addr_get_range X509v3_addr_inherits X509v3_addr_is_canonical X509v3_addr_subset X509v3_addr_validate_path X509v3_addr_validate_resource_set X509v3_asid_add_id_or_range X509v3_asid_add_inherit X509v3_asid_canonize X509v3_asid_inherits X509v3_asid_is_canonical X509v3_asid_subset X509v3_asid_validate_path X509v3_asid_validate_resource_set X509v3_delete_ext X509v3_get_ext X509v3_get_ext_by_NID X509v3_get_ext_by_OBJ X509v3_get_ext_by_critical X509v3_get_ext_count ZINT32_it ZINT64_it ZLONG_it ZUINT32_it ZUINT64_it _shadow_DES_check_key a2d_ASN1_OBJECT a2i_ASN1_ENUMERATED a2i_ASN1_INTEGER a2i_ASN1_STRING a2i_GENERAL_NAME a2i_IPADDRESS a2i_IPADDRESS_NC b2i_PVK_bio b2i_PrivateKey b2i_PrivateKey_bio b2i_PublicKey b2i_PublicKey_bio d2i_ACCESS_DESCRIPTION d2i_ASIdOrRange d2i_ASIdentifierChoice d2i_ASIdentifiers d2i_ASN1_BIT_STRING d2i_ASN1_BMPSTRING d2i_ASN1_ENUMERATED d2i_ASN1_GENERALIZEDTIME d2i_ASN1_GENERALSTRING d2i_ASN1_IA5STRING d2i_ASN1_INTEGER d2i_ASN1_NULL d2i_ASN1_OBJECT d2i_ASN1_OCTET_STRING d2i_ASN1_PRINTABLE d2i_ASN1_PRINTABLESTRING d2i_ASN1_SEQUENCE_ANY d2i_ASN1_SET_ANY d2i_ASN1_T61STRING d2i_ASN1_TIME d2i_ASN1_TYPE d2i_ASN1_UINTEGER d2i_ASN1_UNIVERSALSTRING d2i_ASN1_UTCTIME d2i_ASN1_UTF8STRING d2i_ASN1_VISIBLESTRING d2i_ASRange d2i_AUTHORITY_INFO_ACCESS d2i_AUTHORITY_KEYID d2i_AutoPrivateKey d2i_BASIC_CONSTRAINTS d2i_CERTIFICATEPOLICIES d2i_CMS_ContentInfo d2i_CMS_ReceiptRequest d2i_CMS_bio d2i_CRL_DIST_POINTS d2i_DHparams d2i_DHxparams d2i_DIRECTORYSTRING d2i_DISPLAYTEXT d2i_DIST_POINT d2i_DIST_POINT_NAME d2i_DSAPrivateKey d2i_DSAPrivateKey_bio d2i_DSAPrivateKey_fp d2i_DSAPublicKey d2i_DSA_PUBKEY d2i_DSA_PUBKEY_bio d2i_DSA_PUBKEY_fp d2i_DSA_SIG d2i_DSAparams d2i_ECDSA_SIG d2i_ECPKParameters d2i_ECParameters d2i_ECPrivateKey d2i_ECPrivateKey_bio d2i_ECPrivateKey_fp d2i_EC_PUBKEY d2i_EC_PUBKEY_bio d2i_EC_PUBKEY_fp d2i_EDIPARTYNAME d2i_ESS_CERT_ID d2i_ESS_ISSUER_SERIAL d2i_ESS_SIGNING_CERT d2i_EXTENDED_KEY_USAGE d2i_GENERAL_NAME d2i_GENERAL_NAMES d2i_IPAddressChoice d2i_IPAddressFamily d2i_IPAddressOrRange d2i_IPAddressRange d2i_ISSUING_DIST_POINT d2i_NETSCAPE_CERT_SEQUENCE d2i_NETSCAPE_SPKAC d2i_NETSCAPE_SPKI d2i_NOTICEREF d2i_OCSP_BASICRESP d2i_OCSP_CERTID d2i_OCSP_CERTSTATUS d2i_OCSP_CRLID d2i_OCSP_ONEREQ d2i_OCSP_REQINFO d2i_OCSP_REQUEST d2i_OCSP_RESPBYTES d2i_OCSP_RESPDATA d2i_OCSP_RESPID d2i_OCSP_RESPONSE d2i_OCSP_REVOKEDINFO d2i_OCSP_SERVICELOC d2i_OCSP_SIGNATURE d2i_OCSP_SINGLERESP d2i_OTHERNAME d2i_PBE2PARAM d2i_PBEPARAM d2i_PBKDF2PARAM d2i_PKCS12 d2i_PKCS12_BAGS d2i_PKCS12_MAC_DATA d2i_PKCS12_SAFEBAG d2i_PKCS12_bio d2i_PKCS12_fp d2i_PKCS7 d2i_PKCS7_DIGEST d2i_PKCS7_ENCRYPT d2i_PKCS7_ENC_CONTENT d2i_PKCS7_ENVELOPE d2i_PKCS7_ISSUER_AND_SERIAL d2i_PKCS7_RECIP_INFO d2i_PKCS7_SIGNED d2i_PKCS7_SIGNER_INFO d2i_PKCS7_SIGN_ENVELOPE d2i_PKCS7_bio d2i_PKCS7_fp d2i_PKCS8PrivateKey_bio d2i_PKCS8PrivateKey_fp d2i_PKCS8_PRIV_KEY_INFO d2i_PKCS8_PRIV_KEY_INFO_bio d2i_PKCS8_PRIV_KEY_INFO_fp d2i_PKCS8_bio d2i_PKCS8_fp d2i_PKEY_USAGE_PERIOD d2i_POLICYINFO d2i_POLICYQUALINFO d2i_PROXY_CERT_INFO_EXTENSION d2i_PROXY_POLICY d2i_PUBKEY d2i_PUBKEY_bio d2i_PUBKEY_fp d2i_PrivateKey d2i_PrivateKey_bio d2i_PrivateKey_fp d2i_PublicKey d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_RSAPrivateKey_fp d2i_RSAPublicKey d2i_RSAPublicKey_bio d2i_RSAPublicKey_fp d2i_RSA_OAEP_PARAMS d2i_RSA_PSS_PARAMS d2i_RSA_PUBKEY d2i_RSA_PUBKEY_bio d2i_RSA_PUBKEY_fp d2i_SCT_LIST d2i_SXNET d2i_SXNETID d2i_TS_ACCURACY d2i_TS_MSG_IMPRINT d2i_TS_MSG_IMPRINT_bio d2i_TS_MSG_IMPRINT_fp d2i_TS_REQ d2i_TS_REQ_bio d2i_TS_REQ_fp d2i_TS_RESP d2i_TS_RESP_bio d2i_TS_RESP_fp d2i_TS_STATUS_INFO d2i_TS_TST_INFO d2i_TS_TST_INFO_bio d2i_TS_TST_INFO_fp d2i_USERNOTICE d2i_X509 d2i_X509_ALGOR d2i_X509_ALGORS d2i_X509_ATTRIBUTE d2i_X509_AUX d2i_X509_CERT_AUX d2i_X509_CINF d2i_X509_CRL d2i_X509_CRL_INFO d2i_X509_CRL_bio d2i_X509_CRL_fp d2i_X509_EXTENSION d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_NAME_ENTRY d2i_X509_PUBKEY d2i_X509_REQ d2i_X509_REQ_INFO d2i_X509_REQ_bio d2i_X509_REQ_fp d2i_X509_REVOKED d2i_X509_SIG d2i_X509_VAL d2i_X509_bio d2i_X509_fp err_free_strings_int i2a_ACCESS_DESCRIPTION i2a_ASN1_ENUMERATED i2a_ASN1_INTEGER i2a_ASN1_OBJECT i2a_ASN1_STRING i2b_PVK_bio i2b_PrivateKey_bio i2b_PublicKey_bio i2d_ACCESS_DESCRIPTION i2d_ASIdOrRange i2d_ASIdentifierChoice i2d_ASIdentifiers i2d_ASN1_BIT_STRING i2d_ASN1_BMPSTRING i2d_ASN1_ENUMERATED i2d_ASN1_GENERALIZEDTIME i2d_ASN1_GENERALSTRING i2d_ASN1_IA5STRING i2d_ASN1_INTEGER i2d_ASN1_NULL i2d_ASN1_OBJECT i2d_ASN1_OCTET_STRING i2d_ASN1_PRINTABLE i2d_ASN1_PRINTABLESTRING i2d_ASN1_SEQUENCE_ANY i2d_ASN1_SET_ANY i2d_ASN1_T61STRING i2d_ASN1_TIME i2d_ASN1_TYPE i2d_ASN1_UNIVERSALSTRING i2d_ASN1_UTCTIME i2d_ASN1_UTF8STRING i2d_ASN1_VISIBLESTRING i2d_ASN1_bio_stream i2d_ASRange i2d_AUTHORITY_INFO_ACCESS i2d_AUTHORITY_KEYID i2d_BASIC_CONSTRAINTS i2d_CERTIFICATEPOLICIES i2d_CMS_ContentInfo i2d_CMS_ReceiptRequest i2d_CMS_bio i2d_CMS_bio_stream i2d_CRL_DIST_POINTS i2d_DHparams i2d_DHxparams i2d_DIRECTORYSTRING i2d_DISPLAYTEXT i2d_DIST_POINT i2d_DIST_POINT_NAME i2d_DSAPrivateKey i2d_DSAPrivateKey_bio i2d_DSAPrivateKey_fp i2d_DSAPublicKey i2d_DSA_PUBKEY i2d_DSA_PUBKEY_bio i2d_DSA_PUBKEY_fp i2d_DSA_SIG i2d_DSAparams i2d_ECDSA_SIG i2d_ECPKParameters i2d_ECParameters i2d_ECPrivateKey i2d_ECPrivateKey_bio i2d_ECPrivateKey_fp i2d_EC_PUBKEY i2d_EC_PUBKEY_bio i2d_EC_PUBKEY_fp i2d_EDIPARTYNAME i2d_ESS_CERT_ID i2d_ESS_ISSUER_SERIAL i2d_ESS_SIGNING_CERT i2d_EXTENDED_KEY_USAGE i2d_GENERAL_NAME i2d_GENERAL_NAMES i2d_IPAddressChoice i2d_IPAddressFamily i2d_IPAddressOrRange i2d_IPAddressRange i2d_ISSUING_DIST_POINT i2d_NETSCAPE_CERT_SEQUENCE i2d_NETSCAPE_SPKAC i2d_NETSCAPE_SPKI i2d_NOTICEREF i2d_OCSP_BASICRESP i2d_OCSP_CERTID i2d_OCSP_CERTSTATUS i2d_OCSP_CRLID i2d_OCSP_ONEREQ i2d_OCSP_REQINFO i2d_OCSP_REQUEST i2d_OCSP_RESPBYTES i2d_OCSP_RESPDATA i2d_OCSP_RESPID i2d_OCSP_RESPONSE i2d_OCSP_REVOKEDINFO i2d_OCSP_SERVICELOC i2d_OCSP_SIGNATURE i2d_OCSP_SINGLERESP i2d_OTHERNAME i2d_PBE2PARAM i2d_PBEPARAM i2d_PBKDF2PARAM i2d_PKCS12 i2d_PKCS12_BAGS i2d_PKCS12_MAC_DATA i2d_PKCS12_SAFEBAG i2d_PKCS12_bio i2d_PKCS12_fp i2d_PKCS7 i2d_PKCS7_DIGEST i2d_PKCS7_ENCRYPT i2d_PKCS7_ENC_CONTENT i2d_PKCS7_ENVELOPE i2d_PKCS7_ISSUER_AND_SERIAL i2d_PKCS7_NDEF i2d_PKCS7_RECIP_INFO i2d_PKCS7_SIGNED i2d_PKCS7_SIGNER_INFO i2d_PKCS7_SIGN_ENVELOPE i2d_PKCS7_bio i2d_PKCS7_bio_stream i2d_PKCS7_fp i2d_PKCS8PrivateKeyInfo_bio i2d_PKCS8PrivateKeyInfo_fp i2d_PKCS8PrivateKey_bio i2d_PKCS8PrivateKey_fp i2d_PKCS8PrivateKey_nid_bio i2d_PKCS8PrivateKey_nid_fp i2d_PKCS8_PRIV_KEY_INFO i2d_PKCS8_PRIV_KEY_INFO_bio i2d_PKCS8_PRIV_KEY_INFO_fp i2d_PKCS8_bio i2d_PKCS8_fp i2d_PKEY_USAGE_PERIOD i2d_POLICYINFO i2d_POLICYQUALINFO i2d_PROXY_CERT_INFO_EXTENSION i2d_PROXY_POLICY i2d_PUBKEY i2d_PUBKEY_bio i2d_PUBKEY_fp i2d_PrivateKey i2d_PrivateKey_bio i2d_PrivateKey_fp i2d_PublicKey i2d_RSAPrivateKey i2d_RSAPrivateKey_bio i2d_RSAPrivateKey_fp i2d_RSAPublicKey i2d_RSAPublicKey_bio i2d_RSAPublicKey_fp i2d_RSA_OAEP_PARAMS i2d_RSA_PSS_PARAMS i2d_RSA_PUBKEY i2d_RSA_PUBKEY_bio i2d_RSA_PUBKEY_fp i2d_SCT_LIST i2d_SXNET i2d_SXNETID i2d_TS_ACCURACY i2d_TS_MSG_IMPRINT i2d_TS_MSG_IMPRINT_bio i2d_TS_MSG_IMPRINT_fp i2d_TS_REQ i2d_TS_REQ_bio i2d_TS_REQ_fp i2d_TS_RESP i2d_TS_RESP_bio i2d_TS_RESP_fp i2d_TS_STATUS_INFO i2d_TS_TST_INFO i2d_TS_TST_INFO_bio i2d_TS_TST_INFO_fp i2d_USERNOTICE i2d_X509 i2d_X509_ALGOR i2d_X509_ALGORS i2d_X509_ATTRIBUTE i2d_X509_AUX i2d_X509_CERT_AUX i2d_X509_CINF i2d_X509_CRL i2d_X509_CRL_INFO i2d_X509_CRL_bio i2d_X509_CRL_fp i2d_X509_EXTENSION i2d_X509_EXTENSIONS i2d_X509_NAME i2d_X509_NAME_ENTRY i2d_X509_PUBKEY i2d_X509_REQ i2d_X509_REQ_INFO i2d_X509_REQ_bio i2d_X509_REQ_fp i2d_X509_REVOKED i2d_X509_SIG i2d_X509_VAL i2d_X509_bio i2d_X509_fp i2d_re_X509_CRL_tbs i2d_re_X509_REQ_tbs i2d_re_X509_tbs i2o_ECPublicKey i2o_SCT i2o_SCT_LIST i2s_ASN1_ENUMERATED i2s_ASN1_ENUMERATED_TABLE i2s_ASN1_IA5STRING i2s_ASN1_INTEGER i2s_ASN1_OCTET_STRING i2t_ASN1_OBJECT i2v_ASN1_BIT_STRING i2v_GENERAL_NAME i2v_GENERAL_NAMES o2i_ECPublicKey o2i_SCT o2i_SCT_LIST s2i_ASN1_IA5STRING s2i_ASN1_INTEGER s2i_ASN1_OCTET_STRING v2i_ASN1_BIT_STRING v2i_GENERAL_NAME v2i_GENERAL_NAMES v2i_GENERAL_NAME_ex

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

298KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

992B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/4

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

562B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/liblzo2-2.dll

IMPHASH 1392a6aaf395c44c2abe8956a2d6714d
SHA256 09d3be28f0a87c8e6e1296e494cbc175e7ee77526fe955393a4e3c83748d5c3b
MD5 e4fb2a7c1f92d4e61cffe3f2c0ce9f87
SHA1 e89631550a076ce5d4627eb6a6a3586a8b6a618c
SHA512 13eae80b58728e472df8f578a59519d9b29bc215d10279953b0d06b5fd274cbf178841cf6fa0147c5c9d6e3ff85b49f20c1d454d3ac7e4234a4942e0be8f0812
SSDEEP 3072:5h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKo:w3bRn9ZNnB5NfKo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

87:d5:dd:80:35:a6:f5:b2:42:f7:8d:f7:21:13:cb:22:b4:d8:7a:60:b0:64:3c:a5:75:6d:40:e2:4c:e3:d7:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 26, 2018

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

03:e4:9b:29:ae:75:df:4c:50:dc:16:62:67:07:76:b9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 25, 2016 - Oct 9, 2019

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

@feat.00 __lzo_align_gap __lzo_init_v2 __lzo_ptr_linear _lzo1b_1_compress_func _lzo1b_2_compress_func _lzo1b_3_compress_func _lzo1b_4_compress_func _lzo1b_5_compress_func _lzo1b_6_compress_func _lzo1b_7_compress_func _lzo1b_8_compress_func _lzo1b_99_compress_func _lzo1b_9_compress_func _lzo1b_do_compress _lzo1b_store_run _lzo1c_1_compress_func _lzo1c_2_compress_func _lzo1c_3_compress_func _lzo1c_4_compress_func _lzo1c_5_compress_func _lzo1c_6_compress_func _lzo1c_7_compress_func _lzo1c_8_compress_func _lzo1c_99_compress_func _lzo1c_9_compress_func _lzo1c_do_compress _lzo1c_store_run _lzo_config_check _lzo_version_date _lzo_version_string lzo1_99_compress lzo1_compress lzo1_decompress lzo1_info lzo1a_99_compress lzo1a_compress lzo1a_decompress lzo1a_info lzo1b_1_compress lzo1b_2_compress lzo1b_3_compress lzo1b_4_compress lzo1b_5_compress lzo1b_6_compress lzo1b_7_compress lzo1b_8_compress lzo1b_999_compress lzo1b_999_compress_callback lzo1b_99_compress lzo1b_9_compress lzo1b_compress lzo1b_decompress lzo1b_decompress_safe lzo1c_1_compress lzo1c_2_compress lzo1c_3_compress lzo1c_4_compress lzo1c_5_compress lzo1c_6_compress lzo1c_7_compress lzo1c_8_compress lzo1c_999_compress lzo1c_999_compress_callback lzo1c_99_compress lzo1c_9_compress lzo1c_compress lzo1c_decompress lzo1c_decompress_asm lzo1c_decompress_asm_safe lzo1c_decompress_safe lzo1f_1_compress lzo1f_999_compress lzo1f_999_compress_callback lzo1f_decompress lzo1f_decompress_asm_fast lzo1f_decompress_asm_fast_safe lzo1f_decompress_safe lzo1x_1_11_compress lzo1x_1_12_compress lzo1x_1_15_compress lzo1x_1_compress lzo1x_999_compress lzo1x_999_compress_dict lzo1x_999_compress_internal lzo1x_999_compress_level lzo1x_decompress lzo1x_decompress_asm lzo1x_decompress_asm_fast lzo1x_decompress_asm_fast_safe lzo1x_decompress_asm_safe lzo1x_decompress_dict_safe lzo1x_decompress_safe lzo1x_optimize lzo1y_1_compress lzo1y_999_compress lzo1y_999_compress_dict lzo1y_999_compress_internal lzo1y_999_compress_level lzo1y_decompress lzo1y_decompress_asm lzo1y_decompress_asm_fast lzo1y_decompress_asm_fast_safe lzo1y_decompress_asm_safe lzo1y_decompress_dict_safe lzo1y_decompress_safe lzo1y_optimize lzo1z_999_compress lzo1z_999_compress_dict lzo1z_999_compress_internal lzo1z_999_compress_level lzo1z_decompress lzo1z_decompress_dict_safe lzo1z_decompress_safe lzo2a_999_compress lzo2a_999_compress_callback lzo2a_decompress lzo2a_decompress_safe lzo_adler32 lzo_copyright lzo_crc32 lzo_get_crc32_table lzo_memcmp lzo_memcpy lzo_memmove lzo_memset lzo_version lzo_version_date lzo_version_string

Name

.text

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

964B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

884B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/libpkcs11-helper-1.dll

IMPHASH af3e5c0abcb5bcd32311606870921b2c
SHA256 431812271d60e389b0891ea84cce54767a9b6eb30ba7fac40fdedf7b8f6b4bb8
MD5 7578cb46e21e85da20490f4e78f83619
SHA1 f70358398a2cf3cafea959d1254a46d040921dee
SHA512 c8c822c17af04c7c10bfd7f6f3b3612545592ede9b852db5fdc6472c79eee7370bff8a680d9f001a66aeaf3aaa3176114e4ae07f9cfea9d178c9dc909af26df1
SSDEEP 3072:qBpXbIVowL0VhZf1BDuHO3a6CQxh9QQU7kVTAHluobjrzEJzgV2:ibKop11BDqOLCQxh9QQU7kVTAHluobje
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

94:bd:74:f6:9d:f9:26:84:41:b4:d7:e3:6d:4f:f3:a0:58:9e:8b:e3:db:e7:40:c4:9c:64:e9:b1:8b:11:63:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 26, 2018

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

03:e4:9b:29:ae:75:df:4c:50:dc:16:62:67:07:76:b9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 25, 2016 - Oct 9, 2019

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

libcrypto-1_1

BN_bin2bn BN_clear_free CRYPTO_get_ex_new_index DSA_SIG_free DSA_SIG_new DSA_SIG_set0 DSA_free DSA_get_default_method DSA_get_ex_data DSA_meth_dup DSA_meth_free DSA_meth_set1_name DSA_meth_set_sign DSA_set_ex_data DSA_set_method EVP_PKEY_free EVP_PKEY_get1_DSA EVP_PKEY_get1_RSA EVP_PKEY_id OPENSSL_init_crypto RSA_free RSA_get_default_method RSA_get_ex_data RSA_meth_dup RSA_meth_free RSA_meth_set1_name RSA_meth_set_flags RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_set_ex_data RSA_set_method RSA_size X509_NAME_cmp X509_NAME_oneline X509_cmp_current_time X509_dup X509_free X509_get_issuer_name X509_get_pubkey X509_get_subject_name X509_getm_notAfter X509_getm_notBefore X509_new X509_verify d2i_X509

kernel32

CloseHandle CreateEventA CreateMutexA DeleteCriticalSection EnterCriticalSection FileTimeToSystemTime FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA QueryPerformanceCounter ReleaseMutex SetEvent SetUnhandledExceptionFilter Sleep SystemTimeToTzSpecificLocalTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

__dllonexit _amsg_exit _beginthreadex _exit _initterm _iob _lock _onexit _snwprintf calloc free fwprintf fwrite getenv gmtime isgraph isxdigit localtime malloc memmove memset mktime raise sprintf sscanf strchr strcmp strlen strncat strncmp strncpy strrchr _unlock abort asctime time vfprintf wcscpy

user32

MessageBoxW

pkcs11h_addProvider pkcs11h_certificate_create pkcs11h_certificate_decrypt pkcs11h_certificate_decryptAny pkcs11h_certificate_deserializeCertificateId pkcs11h_certificate_duplicateCertificateId pkcs11h_certificate_ensureCertificateAccess pkcs11h_certificate_ensureKeyAccess pkcs11h_certificate_enumCertificateIds pkcs11h_certificate_enumTokenCertificateIds pkcs11h_certificate_freeCertificate pkcs11h_certificate_freeCertificateId pkcs11h_certificate_freeCertificateIdList pkcs11h_certificate_getCertificateBlob pkcs11h_certificate_getCertificateId pkcs11h_certificate_getPromptMask pkcs11h_certificate_getUserData pkcs11h_certificate_lockSession pkcs11h_certificate_releaseSession pkcs11h_certificate_serializeCertificateId pkcs11h_certificate_setCertificateIdCertificateBlob pkcs11h_certificate_setPromptMask pkcs11h_certificate_setUserData pkcs11h_certificate_sign pkcs11h_certificate_signAny pkcs11h_certificate_signRecover pkcs11h_certificate_unwrap pkcs11h_data_del pkcs11h_data_enumDataObjects pkcs11h_data_freeDataIdList pkcs11h_data_get pkcs11h_data_put pkcs11h_engine_setCrypto pkcs11h_engine_setSystem pkcs11h_forkFixup pkcs11h_getFeatures pkcs11h_getLogLevel pkcs11h_getMessage pkcs11h_getVersion pkcs11h_initialize pkcs11h_logout pkcs11h_openssl_createSession pkcs11h_openssl_freeSession pkcs11h_openssl_getCleanupHook pkcs11h_openssl_getX509 pkcs11h_openssl_session_getEVP pkcs11h_openssl_session_getRSA pkcs11h_openssl_session_getX509 pkcs11h_openssl_setCleanupHook pkcs11h_plugAndPlay pkcs11h_removeProvider pkcs11h_setForkMode pkcs11h_setLogHook pkcs11h_setLogLevel pkcs11h_setMaxLoginRetries pkcs11h_setPINCachePeriod pkcs11h_setPINPromptHook pkcs11h_setProtectedAuthentication pkcs11h_setSlotEventHook pkcs11h_setTokenPromptHook pkcs11h_terminate pkcs11h_token_deserializeTokenId pkcs11h_token_duplicateTokenId pkcs11h_token_ensureAccess pkcs11h_token_enumTokenIds pkcs11h_token_freeTokenId pkcs11h_token_freeTokenIdList pkcs11h_token_login pkcs11h_token_logout pkcs11h_token_sameTokenId pkcs11h_token_serializeTokenId

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

188B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/libssl-1_1.dll

IMPHASH b9413037e05b4bf70b0c16fe0cfabfdd
SHA256 0393c11615c633a9360f22658e0427b30ae9646bda1fac457b1a6e4bbe96f535
MD5 978675b7a520ca5192500b307b31c581
SHA1 53a7c43907213698c97549c27c581e33c7c1fe0b
SHA512 1c940ae48b90bf613952e8b778e5781fcb61c95316a55aaeb4d1739bda5396095acbd7bbc14d7430de3e0202d1e3390e20ebf9a5942a45c7075128f881da532d
SSDEEP 12288:aBZQztry5yH1uynaYRHBnT6BTfKSi2Jq6pxOYdoqBTYEbQu:aBZQztry5yH1uyna8nT6BTfKO/OYdoqp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Digest

34:08:5c:88:64:a7:9e:98:dd:6a:25:c4:01:63:4a:e0:c4:f5:0f:31:19:73:1c:db:45:b1:b2:3a:a0:9a:06:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 26, 2018

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

03:e4:9b:29:ae:75:df:4c:50:dc:16:62:67:07:76:b9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 25, 2016 - Oct 9, 2019

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libcrypto-1_1

ASN1_OCTET_STRING_it ASN1_get_object ASN1_item_d2i ASN1_item_free ASN1_item_i2d ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_WAIT_CTX_new ASYNC_get_current_job ASYNC_start_job BIO_ADDR_clear BIO_ADDR_free BIO_ADDR_new BIO_callback_ctrl BIO_clear_flags BIO_copy_next_retry BIO_ctrl BIO_dump_indent BIO_f_buffer BIO_find_type BIO_free BIO_free_all BIO_get_data BIO_get_init BIO_get_retry_reason BIO_get_shutdown BIO_int_ctrl BIO_method_type BIO_new BIO_next BIO_pop BIO_printf BIO_push BIO_puts BIO_read BIO_s_connect BIO_s_file BIO_s_mem BIO_s_socket BIO_set_data BIO_set_flags BIO_set_init BIO_set_next BIO_set_retry_reason BIO_set_shutdown BIO_snprintf BIO_test_flags BIO_up_ref BIO_write BN_bin2bn BN_bn2bin BN_clear_free BN_copy BN_dup BN_free BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_8192 BN_is_zero BN_new BN_num_bits BN_set_word BN_ucmp BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_reverse COMP_CTX_free COMP_CTX_get_method COMP_CTX_new COMP_compress_block COMP_expand_block COMP_get_name COMP_get_type COMP_zlib CONF_imodule_get_value CONF_module_add CONF_parse_list CRYPTO_THREAD_lock_free CRYPTO_THREAD_lock_new CRYPTO_THREAD_read_lock CRYPTO_THREAD_run_once CRYPTO_THREAD_unlock CRYPTO_THREAD_write_lock CRYPTO_atomic_add CRYPTO_clear_free CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_memdup CRYPTO_new_ex_data CRYPTO_realloc CRYPTO_set_ex_data CRYPTO_strdup CRYPTO_strndup CRYPTO_zalloc CTLOG_STORE_free CTLOG_STORE_load_default_file CTLOG_STORE_load_file CTLOG_STORE_new CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time DH_check_params DH_free DH_get0_key DH_get0_pqg DH_get_1024_160 DH_get_2048_224 DH_new DH_security_bits DH_set0_key DH_set0_pqg EC_GROUP_get_curve_name EC_KEY_can_sign EC_KEY_free EC_KEY_get0_group EC_KEY_get0_public_key EC_KEY_get_conv_form EC_KEY_new_by_curve_name EC_curve_nist2nid ENGINE_finish ENGINE_get_ssl_client_cert_function ENGINE_init ENGINE_load_ssl_client_cert ERR_add_error_data ERR_clear_error ERR_func_error_string ERR_load_strings ERR_peek_error ERR_peek_last_error ERR_put_error EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_free EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_reset EVP_CIPHER_block_size EVP_CIPHER_flags EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_Cipher EVP_CipherInit_ex EVP_DecryptFinal EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_EncryptFinal EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_ctrl EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_new EVP_MD_CTX_reset EVP_MD_CTX_set_flags EVP_MD_block_size EVP_MD_size EVP_MD_type EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_free EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_asn1_find_str EVP_PKEY_asn1_get0_info EVP_PKEY_assign EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_free EVP_PKEY_get0_DH EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get1_tls_encodedpoint EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_mac_key EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_security_bits EVP_PKEY_set1_DH EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_set_type EVP_PKEY_size EVP_PKEY_up_ref EVP_SignFinal EVP_VerifyFinal EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_128_ccm EVP_aes_128_gcm EVP_aes_192_cbc EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha256 EVP_aes_256_ccm EVP_aes_256_gcm EVP_camellia_128_cbc EVP_camellia_256_cbc EVP_chacha20_poly1305 EVP_des_cbc EVP_des_ede3_cbc EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_idea_cbc EVP_md5 EVP_md5_sha1 EVP_rc2_40_cbc EVP_rc2_cbc EVP_rc4 EVP_rc4_hmac_md5 EVP_seed_cbc EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512 FIPS_mode HMAC_CTX_free HMAC_CTX_new HMAC_Final HMAC_Init_ex HMAC_Update HMAC_size INT32_it MD5_Init MD5_Transform NCONF_get_section OBJ_NAME_add OBJ_bsearch_ OBJ_find_sigid_algs OBJ_find_sigid_by_algs OBJ_ln2nid OBJ_nid2sn OBJ_sn2nid OCSP_BASICRESP_free OCSP_RESPID_free OCSP_RESPONSE_free OCSP_SINGLERESP_get1_ext_d2i OCSP_resp_count OCSP_resp_get0 OCSP_response_get1_basic OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_LH_delete OPENSSL_LH_doall_arg OPENSSL_LH_free OPENSSL_LH_get_down_load OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_num_items OPENSSL_LH_retrieve OPENSSL_LH_set_down_load OPENSSL_atexit OPENSSL_cleanse OPENSSL_die OPENSSL_init_crypto OPENSSL_sk_dup OPENSSL_sk_find OPENSSL_sk_free OPENSSL_sk_insert OPENSSL_sk_new OPENSSL_sk_new_null OPENSSL_sk_num OPENSSL_sk_pop OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_set OPENSSL_sk_set_cmp_func OPENSSL_sk_shift OPENSSL_sk_sort OPENSSL_sk_value PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_read_bio PEM_read_bio_DHparams PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_X509 PEM_read_bio_X509_AUX RAND_add RAND_bytes RSA_flags RSA_free RSA_private_decrypt RSA_size RSA_up_ref SCT_LIST_free SCT_LIST_validate SCT_get_validation_status SCT_set_source SHA1_Init SHA1_Transform SHA224_Init SHA256_Init SHA256_Transform SHA384_Init SHA512_Init SHA512_Transform SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier_BN SRP_get_default_gN UINT32_it X509_EXTENSION_free X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_hash_dir X509_NAME_cmp X509_NAME_dup X509_NAME_free X509_NAME_hash X509_STORE_CTX_free X509_STORE_CTX_get0_chain X509_STORE_CTX_get0_param X509_STORE_CTX_get1_chain X509_STORE_CTX_get_error X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_set0_dane X509_STORE_CTX_set_default X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_flags X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_add_lookup X509_STORE_free X509_STORE_load_locations X509_STORE_new X509_STORE_set_default_paths X509_STORE_up_ref X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_move_peername X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_trust X509_certificate_type X509_chain_check_suiteb X509_chain_up_ref X509_check_private_key X509_cmp X509_free X509_get0_pubkey X509_get_ext_d2i X509_get_extension_flags X509_get_issuer_name X509_get_key_usage X509_get_signature_nid X509_get_subject_name X509_it X509_up_ref X509_verify_cert X509_verify_cert_error_string ZINT32_it ZINT64_it ZUINT64_it d2i_OCSP_RESPID d2i_OCSP_RESPONSE d2i_PUBKEY d2i_PrivateKey d2i_PrivateKey_bio d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_X509 d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_bio err_free_strings_int i2d_OCSP_RESPID i2d_X509 i2d_X509_EXTENSIONS i2d_X509_NAME o2i_SCT_LIST

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetSystemTime GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _errno _initterm _iob _lock _onexit time _stricmp _strnicmp calloc free fwrite malloc memchr memcmp memcpy memmove memset qsort strchr strcmp strlen strncmp _unlock abort vfprintf

BIO_f_ssl BIO_new_buffer_ssl_connect BIO_new_ssl BIO_new_ssl_connect BIO_ssl_copy_session_id BIO_ssl_shutdown DTLS_client_method DTLS_method DTLS_server_method DTLSv1_2_client_method DTLSv1_2_method DTLSv1_2_server_method DTLSv1_client_method DTLSv1_listen DTLSv1_method DTLSv1_server_method ERR_load_SSL_strings OPENSSL_init_ssl PEM_read_SSL_SESSION PEM_read_bio_SSL_SESSION PEM_write_SSL_SESSION PEM_write_bio_SSL_SESSION SRP_Calc_A_param SSL_CIPHER_description SSL_CIPHER_find SSL_CIPHER_get_auth_nid SSL_CIPHER_get_bits SSL_CIPHER_get_cipher_nid SSL_CIPHER_get_digest_nid SSL_CIPHER_get_id SSL_CIPHER_get_kx_nid SSL_CIPHER_get_name SSL_CIPHER_get_version SSL_CIPHER_is_aead SSL_COMP_add_compression_method SSL_COMP_get0_name SSL_COMP_get_compression_methods SSL_COMP_get_id SSL_COMP_get_name SSL_COMP_set0_compression_methods SSL_CONF_CTX_clear_flags SSL_CONF_CTX_finish SSL_CONF_CTX_free SSL_CONF_CTX_new SSL_CONF_CTX_set1_prefix SSL_CONF_CTX_set_flags SSL_CONF_CTX_set_ssl SSL_CONF_CTX_set_ssl_ctx SSL_CONF_cmd SSL_CONF_cmd_argv SSL_CONF_cmd_value_type SSL_CTX_SRP_CTX_free SSL_CTX_SRP_CTX_init SSL_CTX_add_client_CA SSL_CTX_add_client_custom_ext SSL_CTX_add_server_custom_ext SSL_CTX_add_session SSL_CTX_callback_ctrl SSL_CTX_check_private_key SSL_CTX_clear_options SSL_CTX_config SSL_CTX_ct_is_enabled SSL_CTX_ctrl SSL_CTX_dane_clear_flags SSL_CTX_dane_enable SSL_CTX_dane_mtype_set SSL_CTX_dane_set_flags SSL_CTX_enable_ct SSL_CTX_flush_sessions SSL_CTX_free SSL_CTX_get0_certificate SSL_CTX_get0_ctlog_store SSL_CTX_get0_param SSL_CTX_get0_privatekey SSL_CTX_get0_security_ex_data SSL_CTX_get_cert_store SSL_CTX_get_ciphers SSL_CTX_get_client_CA_list SSL_CTX_get_client_cert_cb SSL_CTX_get_default_passwd_cb SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_ex_data SSL_CTX_get_info_callback SSL_CTX_get_options SSL_CTX_get_quiet_shutdown SSL_CTX_get_security_callback SSL_CTX_get_security_level SSL_CTX_get_ssl_method SSL_CTX_get_timeout SSL_CTX_get_verify_callback SSL_CTX_get_verify_depth SSL_CTX_get_verify_mode SSL_CTX_has_client_custom_ext SSL_CTX_load_verify_locations SSL_CTX_new SSL_CTX_remove_session SSL_CTX_sess_get_get_cb SSL_CTX_sess_get_new_cb SSL_CTX_sess_get_remove_cb SSL_CTX_sess_set_get_cb SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb SSL_CTX_sessions SSL_CTX_set0_ctlog_store SSL_CTX_set0_security_ex_data SSL_CTX_set1_param SSL_CTX_set_alpn_protos SSL_CTX_set_alpn_select_cb SSL_CTX_set_cert_cb SSL_CTX_set_cert_store SSL_CTX_set_cert_verify_callback SSL_CTX_set_cipher_list SSL_CTX_set_client_CA_list SSL_CTX_set_client_cert_cb SSL_CTX_set_client_cert_engine SSL_CTX_set_cookie_generate_cb SSL_CTX_set_cookie_verify_cb SSL_CTX_set_ct_validation_callback SSL_CTX_set_ctlog_list_file SSL_CTX_set_default_ctlog_list_file SSL_CTX_set_default_passwd_cb SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_default_read_buffer_len SSL_CTX_set_default_verify_dir SSL_CTX_set_default_verify_file SSL_CTX_set_default_verify_paths SSL_CTX_set_ex_data SSL_CTX_set_generate_session_id SSL_CTX_set_info_callback SSL_CTX_set_msg_callback SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_not_resumable_session_callback SSL_CTX_set_options SSL_CTX_set_psk_client_callback SSL_CTX_set_psk_server_callback SSL_CTX_set_purpose SSL_CTX_set_quiet_shutdown SSL_CTX_set_security_callback SSL_CTX_set_security_level SSL_CTX_set_session_id_context SSL_CTX_set_srp_cb_arg SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_password SSL_CTX_set_srp_strength SSL_CTX_set_srp_username SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_ssl_version SSL_CTX_set_timeout SSL_CTX_set_tlsext_use_srtp SSL_CTX_set_tmp_dh_callback SSL_CTX_set_trust SSL_CTX_set_verify SSL_CTX_set_verify_depth SSL_CTX_up_ref SSL_CTX_use_PrivateKey SSL_CTX_use_PrivateKey_ASN1 SSL_CTX_use_PrivateKey_file SSL_CTX_use_RSAPrivateKey SSL_CTX_use_RSAPrivateKey_ASN1 SSL_CTX_use_RSAPrivateKey_file SSL_CTX_use_certificate SSL_CTX_use_certificate_ASN1 SSL_CTX_use_certificate_chain_file SSL_CTX_use_certificate_file SSL_CTX_use_psk_identity_hint SSL_CTX_use_serverinfo SSL_CTX_use_serverinfo_file SSL_SESSION_free SSL_SESSION_get0_cipher SSL_SESSION_get0_hostname SSL_SESSION_get0_id_context SSL_SESSION_get0_peer SSL_SESSION_get0_ticket SSL_SESSION_get_compress_id SSL_SESSION_get_ex_data SSL_SESSION_get_id SSL_SESSION_get_master_key SSL_SESSION_get_protocol_version SSL_SESSION_get_ticket_lifetime_hint SSL_SESSION_get_time SSL_SESSION_get_timeout SSL_SESSION_has_ticket SSL_SESSION_new SSL_SESSION_print SSL_SESSION_print_fp SSL_SESSION_print_keylog SSL_SESSION_set1_id SSL_SESSION_set1_id_context SSL_SESSION_set_ex_data SSL_SESSION_set_time SSL_SESSION_set_timeout SSL_SESSION_up_ref SSL_SRP_CTX_free SSL_SRP_CTX_init SSL_accept SSL_add1_host SSL_add_client_CA SSL_add_dir_cert_subjects_to_stack SSL_add_file_cert_subjects_to_stack SSL_add_ssl_module SSL_alert_desc_string SSL_alert_desc_string_long SSL_alert_type_string SSL_alert_type_string_long SSL_callback_ctrl SSL_certs_clear SSL_check_chain SSL_check_private_key SSL_clear SSL_clear_options SSL_client_version SSL_config SSL_connect SSL_copy_session_id SSL_ct_is_enabled SSL_ctrl SSL_dane_clear_flags SSL_dane_enable SSL_dane_set_flags SSL_dane_tlsa_add SSL_do_handshake SSL_dup SSL_dup_CA_list SSL_enable_ct SSL_export_keying_material SSL_extension_supported SSL_free SSL_get0_alpn_selected SSL_get0_dane SSL_get0_dane_authority SSL_get0_dane_tlsa SSL_get0_next_proto_negotiated SSL_get0_param SSL_get0_peer_scts SSL_get0_peername SSL_get0_security_ex_data SSL_get0_verified_chain SSL_get1_session SSL_get1_supported_ciphers SSL_get_SSL_CTX SSL_get_all_async_fds SSL_get_certificate SSL_get_changed_async_fds SSL_get_cipher_list SSL_get_ciphers SSL_get_client_CA_list SSL_get_client_ciphers SSL_get_client_random SSL_get_current_cipher SSL_get_current_compression SSL_get_current_expansion SSL_get_default_passwd_cb SSL_get_default_passwd_cb_userdata SSL_get_default_timeout SSL_get_error SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_fd SSL_get_finished SSL_get_info_callback SSL_get_options SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_get_peer_finished SSL_get_privatekey SSL_get_psk_identity SSL_get_psk_identity_hint SSL_get_quiet_shutdown SSL_get_rbio SSL_get_read_ahead SSL_get_rfd SSL_get_security_callback SSL_get_security_level SSL_get_selected_srtp_profile SSL_get_server_random SSL_get_servername SSL_get_servername_type SSL_get_session SSL_get_shared_ciphers SSL_get_shared_sigalgs SSL_get_shutdown SSL_get_sigalgs SSL_get_srp_N SSL_get_srp_g SSL_get_srp_userinfo SSL_get_srp_username SSL_get_srtp_profiles SSL_get_ssl_method SSL_get_state SSL_get_verify_callback SSL_get_verify_depth SSL_get_verify_mode SSL_get_verify_result SSL_get_version SSL_get_wbio SSL_get_wfd SSL_has_matching_session_id SSL_has_pending SSL_in_before SSL_in_init SSL_is_dtls SSL_is_init_finished SSL_is_server SSL_load_client_CA_file SSL_new SSL_peek SSL_pending SSL_read SSL_renegotiate SSL_renegotiate_abbreviated SSL_renegotiate_pending SSL_rstate_string SSL_rstate_string_long SSL_select_next_proto SSL_session_reused SSL_set0_rbio SSL_set0_security_ex_data SSL_set0_wbio SSL_set1_host SSL_set1_param SSL_set_SSL_CTX SSL_set_accept_state SSL_set_alpn_protos SSL_set_bio SSL_set_cert_cb SSL_set_cipher_list SSL_set_client_CA_list SSL_set_connect_state SSL_set_ct_validation_callback SSL_set_debug SSL_set_default_passwd_cb SSL_set_default_passwd_cb_userdata SSL_set_default_read_buffer_len SSL_set_ex_data SSL_set_fd SSL_set_generate_session_id SSL_set_hostflags SSL_set_info_callback SSL_set_msg_callback SSL_set_not_resumable_session_callback SSL_set_options SSL_set_psk_client_callback SSL_set_psk_server_callback SSL_set_purpose SSL_set_quiet_shutdown SSL_set_read_ahead SSL_set_rfd SSL_set_security_callback SSL_set_security_level SSL_set_session SSL_set_session_id_context SSL_set_session_secret_cb SSL_set_session_ticket_ext SSL_set_session_ticket_ext_cb SSL_set_shutdown SSL_set_srp_server_param SSL_set_srp_server_param_pw SSL_set_ssl_method SSL_set_tlsext_use_srtp SSL_set_tmp_dh_callback SSL_set_trust SSL_set_verify SSL_set_verify_depth SSL_set_verify_result SSL_set_wfd SSL_shutdown SSL_srp_server_param_with_username SSL_state_string SSL_state_string_long SSL_up_ref SSL_use_PrivateKey SSL_use_PrivateKey_ASN1 SSL_use_PrivateKey_file SSL_use_RSAPrivateKey SSL_use_RSAPrivateKey_ASN1 SSL_use_RSAPrivateKey_file SSL_use_certificate SSL_use_certificate_ASN1 SSL_use_certificate_chain_file SSL_use_certificate_file SSL_use_psk_identity_hint SSL_version SSL_waiting_for_async SSL_want SSL_write TLS_client_method TLS_method TLS_server_method TLSv1_1_client_method TLSv1_1_method TLSv1_1_server_method TLSv1_2_client_method TLSv1_2_method TLSv1_2_server_method TLSv1_client_method TLSv1_method TLSv1_server_method d2i_SSL_SESSION i2d_SSL_SESSION

Name

.text

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/4

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

562B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/openssl.exe

IMPHASH 595e263f4a05bfccd8161501a32a3037
SHA256 9f5e914b2f67c3be6bc422064a5fa86067b4cb4976c6f1c1d8fb0b5fb8b94be0
MD5 bda3e7e4198d5c9f2d5662dc791a3076
SHA1 80436f3de7e1372d8287d10784631aaa06e9c929
SHA512 b69e2efe1415a460c4b4a05455a771d35d2ee0e5a665a68a0407ad4a916319a93121803d172b384e40fa0330a9157de6b1b8b7d39751e30e98593b091db3386b
SSDEEP 12288:gYas1FhTouoD09FEJTQDd+/hQAf1HqS36qTgCN:gYasbhTo/DWmJ8DENKSxDN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d1:f5:f5:b8:54:08:ce:21:9e:7a:d9:6c:de:43:18:0f:e4:2c:c5:b6:8e:a9:cb:75:61:31:ba:0b:8c:4a:de:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 26, 2018

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

03:e4:9b:29:ae:75:df:4c:50:dc:16:62:67:07:76:b9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 25, 2016 - Oct 9, 2019

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

libcrypto-1_1

AES_cbc_encrypt AES_encrypt AES_ige_encrypt AES_options AES_set_encrypt_key ASN1_ENUMERATED_free ASN1_ENUMERATED_new ASN1_ENUMERATED_set ASN1_GENERALIZEDTIME_free ASN1_GENERALIZEDTIME_new ASN1_GENERALIZEDTIME_print ASN1_GENERALIZEDTIME_set_string ASN1_INTEGER_free ASN1_INTEGER_get ASN1_INTEGER_new ASN1_INTEGER_set ASN1_INTEGER_to_BN ASN1_OBJECT_free ASN1_PRINTABLE_type ASN1_STRING_cmp ASN1_STRING_get0_data ASN1_STRING_length ASN1_STRING_set ASN1_STRING_set_default_mask_asc ASN1_TIME_diff ASN1_TIME_free ASN1_TIME_new ASN1_TIME_print ASN1_TIME_set_string ASN1_TYPE_free ASN1_TYPE_get ASN1_TYPE_new ASN1_UNIVERSALSTRING_to_string ASN1_UTCTIME_free ASN1_UTCTIME_new ASN1_UTCTIME_set_string ASN1_d2i_bio ASN1_generate_nconf ASN1_i2d_bio ASN1_item_unpack ASN1_parse_dump ASN1_tag2str ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_new ASYNC_cleanup_thread ASYNC_init_thread ASYNC_is_capable ASYNC_start_job BF_cbc_encrypt BF_options BF_set_key BIO_ADDRINFO_address BIO_ADDRINFO_family BIO_ADDRINFO_free BIO_ADDRINFO_next BIO_ADDRINFO_protocol BIO_ADDRINFO_socktype BIO_ADDR_free BIO_ADDR_new BIO_ADDR_rawaddress BIO_ADDR_rawport BIO_accept_ex BIO_closesocket BIO_connect BIO_ctrl BIO_debug_callback BIO_dump BIO_dump_indent BIO_f_base64 BIO_f_buffer BIO_f_cipher BIO_f_md BIO_f_nbio_test BIO_free BIO_free_all BIO_get_callback_arg BIO_get_retry_reason BIO_gets BIO_int_ctrl BIO_listen BIO_lookup BIO_new BIO_new_connect BIO_new_dgram BIO_new_file BIO_new_fp BIO_new_mem_buf BIO_new_socket BIO_number_read BIO_number_written BIO_parse_hostserv BIO_pop BIO_printf BIO_push BIO_puts BIO_read BIO_s_accept BIO_s_connect BIO_s_file BIO_s_mem BIO_s_null BIO_set_callback BIO_set_callback_arg BIO_set_flags BIO_snprintf BIO_sock_info BIO_sock_init BIO_sock_should_retry BIO_socket BIO_socket_nbio BIO_test_flags BIO_write BN_CTX_free BN_CTX_new BN_GENCB_free BN_GENCB_get_arg BN_GENCB_new BN_GENCB_set BN_add_word BN_bin2bn BN_bn2bin BN_bn2dec BN_bn2hex BN_cmp BN_dec2bn BN_free BN_generate_prime_ex BN_hex2bn BN_is_odd BN_is_prime_ex BN_is_zero BN_mod_exp BN_new BN_num_bits BN_options BN_print BN_pseudo_rand BN_rshift1 BN_set_word BN_to_ASN1_INTEGER BUF_MEM_free BUF_MEM_grow BUF_MEM_new BUF_reverse CAST_cbc_encrypt CAST_set_key CMS_ContentInfo_free CMS_ContentInfo_print_ctx CMS_EncryptedData_decrypt CMS_EncryptedData_encrypt CMS_ReceiptRequest_create0 CMS_ReceiptRequest_free CMS_ReceiptRequest_get0_values CMS_RecipientInfo_get0_pkey_ctx CMS_RecipientInfo_kari_get0_ctx CMS_RecipientInfo_type CMS_SignerInfo_get0_pkey_ctx CMS_add0_recipient_key CMS_add0_recipient_password CMS_add1_ReceiptRequest CMS_add1_recipient_cert CMS_add1_signer CMS_compress CMS_data CMS_data_create CMS_decrypt CMS_decrypt_set1_key CMS_decrypt_set1_password CMS_decrypt_set1_pkey CMS_digest_create CMS_digest_verify CMS_encrypt CMS_final CMS_get0_SignerInfos CMS_get0_signers CMS_get1_ReceiptRequest CMS_get1_certs CMS_set1_eContentType CMS_sign CMS_sign_receipt CMS_uncompress CMS_verify CMS_verify_receipt CONF_free CONF_get_section CONF_load CONF_modules_load CRYPTO_clear_free CRYPTO_free CRYPTO_gcm128_aad CRYPTO_gcm128_new CRYPTO_gcm128_release CRYPTO_gcm128_setiv CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memdup CRYPTO_realloc CRYPTO_set_mem_debug CRYPTO_strdup Camellia_cbc_encrypt Camellia_set_key DES_crypt DES_ede3_cbc_encrypt DES_ncbc_encrypt DES_options DES_set_key_unchecked DH_bits DH_check DH_free DH_generate_parameters_ex DH_get0_pqg DH_get_length DH_new DH_size DHparams_print DIST_POINT_free DSA_dup_DH DSA_free DSA_generate_key DSA_generate_parameters_ex DSA_get0_key DSA_get0_pqg DSA_new DSA_print DSA_set0_key DSA_set0_pqg DSA_sign DSA_verify DSAparams_dup DSAparams_print ECDH_compute_key ECDSA_sign ECDSA_verify ECPKParameters_print EC_GROUP_check EC_GROUP_free EC_GROUP_get0_generator EC_GROUP_get_cofactor EC_GROUP_get_curve_GFp EC_GROUP_get_curve_name EC_GROUP_get_degree EC_GROUP_get_order EC_GROUP_get_point_conversion_form EC_GROUP_method_of EC_GROUP_new_by_curve_name EC_GROUP_set_asn1_flag EC_GROUP_set_point_conversion_form EC_GROUP_set_seed EC_KEY_check_key EC_KEY_free EC_KEY_generate_key EC_KEY_get0_group EC_KEY_get0_public_key EC_KEY_new EC_KEY_new_by_curve_name EC_KEY_precompute_mult EC_KEY_print EC_KEY_set_asn1_flag EC_KEY_set_conv_form EC_KEY_set_enc_flags EC_KEY_set_group EC_METHOD_get_field_type EC_POINT_point2bn EC_curve_nid2nist EC_curve_nist2nid EC_get_builtin_curves ENGINE_by_id ENGINE_ctrl ENGINE_ctrl_cmd ENGINE_ctrl_cmd_string ENGINE_finish ENGINE_free ENGINE_get_DH ENGINE_get_DSA ENGINE_get_RAND ENGINE_get_RSA ENGINE_get_ciphers ENGINE_get_digests ENGINE_get_first ENGINE_get_id ENGINE_get_name ENGINE_get_next ENGINE_get_pkey_asn1_meth_str ENGINE_get_pkey_meths ENGINE_init ENGINE_load_private_key ENGINE_load_public_key ENGINE_register_all_complete ENGINE_set_default ERR_clear_error ERR_error_string_n ERR_get_error ERR_peek_error ERR_print_errors ERR_print_errors_fp ERR_reason_error_string EVP_BytesToKey EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_free EVP_CIPHER_CTX_new EVP_CIPHER_CTX_set_padding EVP_CIPHER_do_all_sorted EVP_CIPHER_flags EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_nid EVP_Cipher EVP_CipherInit_ex EVP_DecryptFinal_ex EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerifyFinal EVP_DigestVerifyInit EVP_EncryptFinal_ex EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_new EVP_MD_do_all_sorted EVP_MD_size EVP_MD_type EVP_PBE_find EVP_PKCS82PKEY EVP_PKEY2PKCS8 EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_free EVP_PKEY_CTX_get_app_data EVP_PKEY_CTX_get_keygen_info EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_set_app_data EVP_PKEY_CTX_set_cb EVP_PKEY_add1_attr_by_NID EVP_PKEY_asn1_find EVP_PKEY_asn1_find_str EVP_PKEY_asn1_get0 EVP_PKEY_asn1_get0_info EVP_PKEY_asn1_get_count EVP_PKEY_base_id EVP_PKEY_bits EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_free EVP_PKEY_get0_DSA EVP_PKEY_get0_RSA EVP_PKEY_get0_asn1 EVP_PKEY_get1_DSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_get_default_digest_nid EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_mac_key EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_print_params EVP_PKEY_print_private EVP_PKEY_print_public EVP_PKEY_set1_DSA EVP_PKEY_set1_RSA EVP_PKEY_sign EVP_PKEY_sign_init EVP_PKEY_size EVP_PKEY_verify EVP_PKEY_verify_init EVP_PKEY_verify_recover EVP_PKEY_verify_recover_init EVP_aes_128_wrap EVP_aes_192_wrap EVP_aes_256_cbc EVP_aes_256_wrap EVP_des_ede3_cbc EVP_des_ede3_wrap EVP_get_cipherbyname EVP_get_digestbyname EVP_md4 EVP_md5 EVP_mdc2 EVP_read_pw_string EVP_ripemd160 EVP_sha1 EVP_sha256 GENERAL_NAMES_free GENERAL_NAMES_new GENERAL_NAME_free GENERAL_NAME_get0_value GENERAL_NAME_print HMAC HMAC_CTX_free HMAC_CTX_new HMAC_Final HMAC_Init_ex HMAC_Update IDEA_cbc_encrypt IDEA_options IDEA_set_encrypt_key MD5 NCONF_free NCONF_get_number_e NCONF_get_section NCONF_get_string NCONF_load_bio NCONF_new NETSCAPE_CERT_SEQUENCE_free NETSCAPE_CERT_SEQUENCE_new NETSCAPE_SPKI_b64_decode NETSCAPE_SPKI_b64_encode NETSCAPE_SPKI_free NETSCAPE_SPKI_get_pubkey NETSCAPE_SPKI_new NETSCAPE_SPKI_print NETSCAPE_SPKI_set_pubkey NETSCAPE_SPKI_sign NETSCAPE_SPKI_verify OBJ_NAME_do_all_sorted OBJ_create OBJ_create_objects OBJ_ln2nid OBJ_nid2ln OBJ_nid2obj OBJ_nid2sn OBJ_obj2nid OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OCSP_BASICRESP_free OCSP_BASICRESP_new OCSP_CERTID_free OCSP_REQUEST_add_ext OCSP_REQUEST_free OCSP_REQUEST_new OCSP_REQUEST_print OCSP_REQ_CTX_add1_header OCSP_REQ_CTX_free OCSP_REQ_CTX_http OCSP_REQ_CTX_new OCSP_REQ_CTX_set1_req OCSP_RESPONSE_free OCSP_RESPONSE_new OCSP_RESPONSE_print OCSP_SINGLERESP_add1_ext_i2d OCSP_basic_add1_status OCSP_basic_sign OCSP_basic_verify OCSP_cert_id_new OCSP_cert_status_str OCSP_cert_to_id OCSP_check_nonce OCSP_check_validity OCSP_copy_nonce OCSP_crl_reason_str OCSP_id_get0_info OCSP_id_issuer_cmp OCSP_onereq_get0_id OCSP_parse_url OCSP_request_add0_id OCSP_request_add1_nonce OCSP_request_onereq_count OCSP_request_onereq_get0 OCSP_request_sign OCSP_resp_find_status OCSP_resp_get0_signature OCSP_response_create OCSP_response_get1_basic OCSP_response_status OCSP_response_status_str OCSP_sendreq_nbio OCSP_sendreq_new OPENSSL_LH_free OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_retrieve OPENSSL_LH_strhash OPENSSL_asc2uni OPENSSL_cleanse OPENSSL_die OPENSSL_hexchar2int OPENSSL_hexstr2buf OPENSSL_sk_delete OPENSSL_sk_free OPENSSL_sk_new_null OPENSSL_sk_num OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_shift OPENSSL_sk_value OPENSSL_strlcat OPENSSL_strlcpy OPENSSL_uni2asc OPENSSL_uni2utf8 OpenSSL_version OpenSSL_version_num PBE2PARAM_free PBE2PARAM_it PBEPARAM_free PBEPARAM_it PBKDF2PARAM_free PBKDF2PARAM_it PEM_X509_INFO_read_bio PEM_read_bio PEM_read_bio_CMS PEM_read_bio_DHparams PEM_read_bio_DSAparams PEM_read_bio_ECPKParameters PEM_read_bio_ECPrivateKey PEM_read_bio_EC_PUBKEY PEM_read_bio_NETSCAPE_CERT_SEQUENCE PEM_read_bio_PKCS7 PEM_read_bio_PKCS8 PEM_read_bio_PKCS8_PRIV_KEY_INFO PEM_read_bio_PUBKEY PEM_read_bio_Parameters PEM_read_bio_PrivateKey PEM_read_bio_RSAPublicKey PEM_read_bio_X509 PEM_read_bio_X509_AUX PEM_read_bio_X509_CRL PEM_read_bio_X509_REQ PEM_write_bio PEM_write_bio_CMS_stream PEM_write_bio_DHparams PEM_write_bio_DHxparams PEM_write_bio_DSAPrivateKey PEM_write_bio_DSA_PUBKEY PEM_write_bio_DSAparams PEM_write_bio_ECPKParameters PEM_write_bio_ECPrivateKey PEM_write_bio_EC_PUBKEY PEM_write_bio_NETSCAPE_CERT_SEQUENCE PEM_write_bio_PKCS7 PEM_write_bio_PKCS7_stream PEM_write_bio_PKCS8 PEM_write_bio_PKCS8_PRIV_KEY_INFO PEM_write_bio_PUBKEY PEM_write_bio_Parameters PEM_write_bio_PrivateKey PEM_write_bio_PrivateKey_traditional PEM_write_bio_RSAPrivateKey PEM_write_bio_RSAPublicKey PEM_write_bio_RSA_PUBKEY PEM_write_bio_X509 PEM_write_bio_X509_AUX PEM_write_bio_X509_CRL PEM_write_bio_X509_REQ PEM_write_bio_X509_REQ_NEW PKCS12_SAFEBAG_free PKCS12_SAFEBAG_get0_attr PKCS12_SAFEBAG_get0_attrs PKCS12_SAFEBAG_get0_p8inf PKCS12_SAFEBAG_get0_pkcs8 PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_type PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get_nid PKCS12_create PKCS12_decrypt_skey PKCS12_free PKCS12_get0_mac PKCS12_mac_present PKCS12_parse PKCS12_set_mac PKCS12_unpack_authsafes PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_verify_mac PKCS5_pbe2_set_iv PKCS5_pbe2_set_scrypt PKCS5_pbe_set PKCS7_SIGNED_new PKCS7_add_certificate PKCS7_decrypt PKCS7_encrypt PKCS7_final PKCS7_free PKCS7_get0_signers PKCS7_new PKCS7_print_ctx PKCS7_sign PKCS7_sign_add_signer PKCS7_to_TS_TST_INFO PKCS7_verify PKCS8_PRIV_KEY_INFO_free PKCS8_decrypt PKCS8_pkey_get0_attrs PKCS8_set0_pbe RAND_bytes RAND_file_name RAND_load_file RAND_seed RAND_status RAND_write_file RC2_cbc_encrypt RC2_set_key RC4 RC4_options RC4_set_key RSA_check_key_ex RSA_free RSA_generate_key_ex RSA_get0_key RSA_new RSA_new_method RSA_print RSA_private_decrypt RSA_private_encrypt RSA_public_decrypt RSA_public_encrypt RSA_sign RSA_size RSA_verify SCT_print SCT_validation_status_string SEED_cbc_encrypt SEED_set_key SHA1 SHA256 SHA512 SMIME_read_CMS SMIME_read_PKCS7 SMIME_write_CMS SMIME_write_PKCS7 SRP_VBASE_get1_by_user SRP_VBASE_init SRP_VBASE_new SRP_check_known_gN_param SRP_create_verifier SRP_get_default_gN SRP_user_pwd_free TS_CONF_get_tsa_section TS_CONF_load_certs TS_CONF_set_accuracy TS_CONF_set_certs TS_CONF_set_clock_precision_digits TS_CONF_set_crypto_device TS_CONF_set_def_policy TS_CONF_set_digests TS_CONF_set_ess_cert_id_chain TS_CONF_set_ordering TS_CONF_set_policies TS_CONF_set_serial TS_CONF_set_signer_cert TS_CONF_set_signer_digest TS_CONF_set_signer_key TS_CONF_set_tsa_name TS_MSG_IMPRINT_free TS_MSG_IMPRINT_new TS_MSG_IMPRINT_set_algo TS_MSG_IMPRINT_set_msg TS_REQ_free TS_REQ_new TS_REQ_print_bio TS_REQ_set_cert_req TS_REQ_set_msg_imprint TS_REQ_set_nonce TS_REQ_set_policy_id TS_REQ_set_version TS_REQ_to_TS_VERIFY_CTX TS_RESP_CTX_add_failure_info TS_RESP_CTX_free TS_RESP_CTX_new TS_RESP_CTX_set_signer_digest TS_RESP_CTX_set_status_info TS_RESP_create_response TS_RESP_free TS_RESP_get_token TS_RESP_get_tst_info TS_RESP_new TS_RESP_print_bio TS_RESP_set_status_info TS_RESP_set_tst_info TS_RESP_verify_response TS_RESP_verify_token TS_STATUS_INFO_free TS_STATUS_INFO_new TS_STATUS_INFO_set_status TS_TST_INFO_free TS_TST_INFO_print_bio TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_add_flags TS_VERIFY_CTX_free TS_VERIFY_CTX_new TS_VERIFY_CTX_set_data TS_VERIFY_CTX_set_imprint TS_VERIFY_CTX_set_store TXT_DB_create_index TXT_DB_free TXT_DB_get_by_index TXT_DB_insert TXT_DB_read TXT_DB_write UI_OpenSSL UI_add_input_string UI_add_user_data UI_add_verify_string UI_construct_prompt UI_create_method UI_ctrl UI_destroy_method UI_free UI_get0_user_data UI_get_input_flags UI_get_string_type UI_method_get_closer UI_method_get_opener UI_method_get_reader UI_method_get_writer UI_method_set_closer UI_method_set_opener UI_method_set_reader UI_method_set_writer UI_new_method UI_process UI_set_result WHIRLPOOL X509V3_EXT_CRL_add_nconf X509V3_EXT_REQ_add_nconf X509V3_EXT_add_nconf X509V3_add_value X509V3_conf_free X509V3_parse_list X509V3_set_ctx X509V3_set_nconf X509_ALGOR_free X509_ALGOR_get0 X509_ALGOR_new X509_ATTRIBUTE_count X509_ATTRIBUTE_get0_object X509_ATTRIBUTE_get0_type X509_CRL_add0_revoked X509_CRL_add1_ext_i2d X509_CRL_diff X509_CRL_digest X509_CRL_free X509_CRL_get0_lastUpdate X509_CRL_get0_nextUpdate X509_CRL_get0_signature X509_CRL_get_ext_d2i X509_CRL_get_issuer X509_CRL_http_nbio X509_CRL_new X509_CRL_print X509_CRL_set1_lastUpdate X509_CRL_set1_nextUpdate X509_CRL_set_issuer_name X509_CRL_set_version X509_CRL_sign_ctx X509_CRL_sort X509_CRL_verify X509_EXTENSION_free X509_EXTENSION_get_object X509_INFO_free X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_hash_dir X509_NAME_ENTRY_free X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_add_entry X509_NAME_add_entry_by_NID X509_NAME_add_entry_by_txt X509_NAME_delete_entry X509_NAME_dup X509_NAME_entry_count X509_NAME_free X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_hash X509_NAME_hash_old X509_NAME_new X509_NAME_oneline X509_NAME_print_ex X509_NAME_print_ex_fp X509_OBJECT_free X509_OBJECT_get0_X509 X509_POLICY_NODE_print X509_PURPOSE_get0 X509_PURPOSE_get0_name X509_PURPOSE_get0_sname X509_PURPOSE_get_by_sname X509_PURPOSE_get_count X509_PURPOSE_get_id X509_REQ_add1_attr_by_NID X509_REQ_add1_attr_by_txt X509_REQ_check_private_key X509_REQ_free X509_REQ_get0_pubkey X509_REQ_get_extensions X509_REQ_get_subject_name X509_REQ_new X509_REQ_print X509_REQ_print_ex X509_REQ_set_pubkey X509_REQ_set_subject_name X509_REQ_set_version X509_REQ_sign_ctx X509_REQ_verify X509_REVOKED_add1_ext_i2d X509_REVOKED_new X509_REVOKED_set_revocationDate X509_REVOKED_set_serialNumber X509_SIG_free X509_SIG_get0 X509_STORE_CTX_free X509_STORE_CTX_get0_parent_ctx X509_STORE_CTX_get0_policy_tree X509_STORE_CTX_get1_chain X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_explicit_policy X509_STORE_CTX_get_num_untrusted X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_set0_crls X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_set_cert X509_STORE_CTX_set_flags X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_free X509_STORE_load_locations X509_STORE_new X509_STORE_set1_param X509_STORE_set_default_paths X509_STORE_set_flags X509_STORE_set_lookup_crls X509_STORE_set_verify_cb X509_VERIFY_PARAM_add0_policy X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0 X509_VERIFY_PARAM_get0_name X509_VERIFY_PARAM_get_count X509_VERIFY_PARAM_lookup X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_email X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set1_ip_asc X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_flags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_time X509_add1_reject_object X509_add1_trust_object X509_add_ext X509_alias_get0 X509_alias_set1 X509_check_email X509_check_host X509_check_ip_asc X509_check_private_key X509_check_purpose X509_cmp_time X509_delete_ext X509_digest X509_email_free X509_free X509_get0_extensions X509_get0_notAfter X509_get0_notBefore X509_get0_pubkey X509_get0_pubkey_bitstr X509_get0_signature X509_get1_email X509_get1_ocsp X509_get_X509_PUBKEY X509_get_default_cert_area X509_get_ext X509_get_ext_by_OBJ X509_get_ext_count X509_get_ext_d2i X509_get_issuer_name X509_get_pubkey X509_get_serialNumber X509_get_signature_nid X509_get_subject_name X509_getm_notAfter X509_getm_notBefore X509_gmtime_adj X509_http_nbio X509_issuer_name_hash X509_issuer_name_hash_old X509_keyid_set1 X509_new X509_ocspid_print X509_policy_tree_get0_policies X509_policy_tree_get0_user_policies X509_print X509_print_ex X509_reject_clear X509_set_issuer_name X509_set_pubkey X509_set_serialNumber X509_set_subject_name X509_set_version X509_sign X509_sign_ctx X509_subject_name_hash X509_subject_name_hash_old X509_time_adj_ex X509_to_X509_REQ X509_trust_clear X509_verify X509_verify_cert X509_verify_cert_error_string a2i_ASN1_INTEGER a2i_GENERAL_NAME b2i_PVK_bio b2i_PrivateKey_bio b2i_PublicKey_bio d2i_ASN1_TYPE d2i_CMS_bio d2i_DHparams d2i_DHxparams d2i_DSAparams d2i_ECPKParameters d2i_ECPrivateKey_bio d2i_EC_PUBKEY_bio d2i_OCSP_REQUEST d2i_OCSP_RESPONSE d2i_PKCS12_bio d2i_PKCS7_bio d2i_PKCS8_PRIV_KEY_INFO_bio d2i_PKCS8_bio d2i_PUBKEY_bio d2i_PrivateKey_bio d2i_RSAPrivateKey d2i_RSAPublicKey_bio d2i_TS_REQ_bio d2i_TS_RESP_bio d2i_X509_CRL_bio d2i_X509_REQ_bio d2i_X509_bio i2a_ASN1_INTEGER i2a_ASN1_OBJECT i2b_PVK_bio i2b_PrivateKey_bio i2b_PublicKey_bio i2d_ASN1_TYPE i2d_CMS_bio_stream i2d_DHparams i2d_DHxparams i2d_DSAPrivateKey_bio i2d_DSA_PUBKEY_bio i2d_DSAparams i2d_ECPKParameters i2d_ECPrivateKey_bio i2d_EC_PUBKEY_bio i2d_OCSP_REQUEST i2d_OCSP_RESPONSE i2d_PKCS12_bio i2d_PKCS7_bio i2d_PKCS7_bio_stream i2d_PKCS8_PRIV_KEY_INFO_bio i2d_PKCS8_bio i2d_PUBKEY_bio i2d_PrivateKey_bio i2d_RSAPrivateKey_bio i2d_RSAPublicKey_bio i2d_RSA_PUBKEY_bio i2d_TS_REQ_bio i2d_TS_RESP_bio i2d_X509 i2d_X509_CRL_bio i2d_X509_NAME i2d_X509_PUBKEY i2d_X509_REQ_bio i2d_X509_bio s2i_ASN1_INTEGER

libssl-1_1

BIO_f_ssl BIO_new_ssl DTLS_client_method DTLS_server_method DTLSv1_listen OPENSSL_init_ssl PEM_read_bio_SSL_SESSION PEM_write_bio_SSL_SESSION SSL_CIPHER_description SSL_CIPHER_find SSL_CIPHER_get_id SSL_CIPHER_get_name SSL_CIPHER_get_version SSL_COMP_get_name SSL_CONF_CTX_finish SSL_CONF_CTX_free SSL_CONF_CTX_new SSL_CONF_CTX_set_flags SSL_CONF_CTX_set_ssl_ctx SSL_CONF_cmd SSL_CTX_add_client_custom_ext SSL_CTX_callback_ctrl SSL_CTX_check_private_key SSL_CTX_config SSL_CTX_ctrl SSL_CTX_dane_enable SSL_CTX_enable_ct SSL_CTX_free SSL_CTX_get0_ctlog_store SSL_CTX_get_cert_store SSL_CTX_get_security_callback SSL_CTX_load_verify_locations SSL_CTX_new SSL_CTX_sess_set_get_cb SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb SSL_CTX_set0_security_ex_data SSL_CTX_set1_param SSL_CTX_set_alpn_protos SSL_CTX_set_alpn_select_cb SSL_CTX_set_cert_cb SSL_CTX_set_cipher_list SSL_CTX_set_client_CA_list SSL_CTX_set_client_cert_engine SSL_CTX_set_cookie_generate_cb SSL_CTX_set_cookie_verify_cb SSL_CTX_set_ctlog_list_file SSL_CTX_set_default_ctlog_list_file SSL_CTX_set_default_read_buffer_len SSL_CTX_set_default_verify_dir SSL_CTX_set_default_verify_file SSL_CTX_set_generate_session_id SSL_CTX_set_info_callback SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_not_resumable_session_callback SSL_CTX_set_options SSL_CTX_set_psk_client_callback SSL_CTX_set_psk_server_callback SSL_CTX_set_quiet_shutdown SSL_CTX_set_security_callback SSL_CTX_set_session_id_context SSL_CTX_set_srp_cb_arg SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_strength SSL_CTX_set_srp_username SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_tlsext_use_srtp SSL_CTX_set_verify SSL_CTX_use_PrivateKey SSL_CTX_use_PrivateKey_file SSL_CTX_use_certificate SSL_CTX_use_certificate_file SSL_CTX_use_psk_identity_hint SSL_CTX_use_serverinfo_file SSL_SESSION_free SSL_SESSION_get0_peer SSL_SESSION_get_id SSL_SESSION_new SSL_SESSION_print SSL_SESSION_print_keylog SSL_SESSION_set1_id_context SSL_accept SSL_alert_desc_string_long SSL_alert_type_string_long SSL_callback_ctrl SSL_certs_clear SSL_check_chain SSL_clear SSL_connect SSL_ct_is_enabled SSL_ctrl SSL_dane_enable SSL_dane_set_flags SSL_dane_tlsa_add SSL_do_handshake SSL_export_keying_material SSL_free SSL_get0_alpn_selected SSL_get0_dane_authority SSL_get0_dane_tlsa SSL_get0_next_proto_negotiated SSL_get0_peer_scts SSL_get0_peername SSL_get1_supported_ciphers SSL_get_SSL_CTX SSL_get_certificate SSL_get_ciphers SSL_get_client_CA_list SSL_get_current_cipher SSL_get_current_compression SSL_get_current_expansion SSL_get_error SSL_get_fd SSL_get_options SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_get_rbio SSL_get_selected_srtp_profile SSL_get_servername SSL_get_servername_type SSL_get_session SSL_get_shared_ciphers SSL_get_shared_sigalgs SSL_get_sigalgs SSL_get_srp_N SSL_get_srp_g SSL_get_srp_username SSL_get_verify_result SSL_get_version SSL_get_wbio SSL_has_matching_session_id SSL_has_pending SSL_in_init SSL_is_init_finished SSL_is_server SSL_load_client_CA_file SSL_new SSL_read SSL_renegotiate SSL_select_next_proto SSL_session_reused SSL_set_SSL_CTX SSL_set_accept_state SSL_set_bio SSL_set_connect_state SSL_set_msg_callback SSL_set_options SSL_set_session SSL_set_session_id_context SSL_set_shutdown SSL_set_srp_server_param SSL_set_verify SSL_shutdown SSL_state_string_long SSL_use_PrivateKey SSL_use_certificate SSL_version SSL_waiting_for_async SSL_write TLS_client_method TLS_server_method d2i_SSL_SESSION i2d_SSL_SESSION

kernel32

CloseHandle CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FindFirstFileW FindNextFileW GetCommandLineW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetLastError GetModuleHandleA GetProcAddress GetProcessTimes GetStartupInfoA GetStdHandle GetSystemTime GetSystemTimeAsFileTime GetTickCount GetVersion InitializeCriticalSection LeaveCriticalSection MoveFileW MultiByteToWideChar OpenProcess PeekConsoleInputW PeekNamedPipe QueryPerformanceCounter ReadFile SetConsoleOutputCP SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteFile

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _access _acmdln _amsg_exit _cexit _close _errno _fileno _fmode _initterm _iob _kbhit _lock _lseek _onexit _open _read _setmode time _stricmp atol calloc clearerr exit fclose feof ferror fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwrite getenv islower isspace isupper isxdigit malloc memcmp memcpy memset perror printf putchar puts qsort realloc setbuf signal sscanf strchr strcmp strcpy strerror strlen strncmp strstr strtol strtoul _unlock _write abort atoi tolower toupper vfprintf wcscpy wcslen _unlink _open _fileno _fdopen _close

ws2_32

WSAGetLastError __WSAFDIsSet select setsockopt shutdown

Name

.text

Size

316KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

78B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/4

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/openvpn.exe

IMPHASH cc7ec10bdb316e541479c1aac4677ae7
SHA256 7f4f204769e4f6cdc427de59db783c36ff7c9a12c7f574226363a93174d2bfe9
MD5 9cf337b8932e88ea180e32edef919766
SHA1 0e4886b9d2d79bd6e3f1c8cd9d2430437435fde5
SHA512 6f9d1cb68ff9b33167f7df2646331427f8fbd870e78153d0d0a057b7ab16cf441e8d76ac3585d90a3363c0b7fb7af1c30806c17902cdab406dfcad340f937757
SSDEEP 24576:oYmNSyK2MBcYKpMG3Son6wAfHYaT0bInrUFI2oxG3e/:+SyOBcYKpF6wcHYaT0bIV94I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

f4:a3:b9:24:13:54:49:1c:22:2c:1c:7b:aa:81:f6:29:33:d9:95:4f:c4:54:8e:50:6b:5e:67:6c:14:c8:a6:b1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 26, 2018

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

03:e4:9b:29:ae:75:df:4c:50:dc:16:62:67:07:76:b9

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 25, 2016 - Oct 9, 2019

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

libcrypto-1_1

ASN1_BIT_STRING_free ASN1_BIT_STRING_get_bit ASN1_INTEGER_to_BN ASN1_OBJECT_free ASN1_STRING_to_UTF8 BIO_ctrl BIO_f_base64 BIO_free BIO_free_all BIO_new BIO_new_file BIO_new_mem_buf BIO_push BIO_read BIO_s_mem BIO_test_flags BIO_write BN_bn2dec BN_dup BN_free CRYPTO_free CRYPTO_get_ex_new_index DES_check_key_parity DES_ecb_encrypt DES_is_weak_key DES_set_key_unchecked DES_set_odd_parity DH_free DH_size DSA_bits EC_GROUP_get_curve_name EC_GROUP_order_bits EC_KEY_free EC_KEY_get0_group EC_KEY_new_by_curve_name EC_get_builtin_curves ENGINE_by_id ENGINE_ctrl_cmd_string ENGINE_free ENGINE_get_first ENGINE_get_id ENGINE_get_name ENGINE_get_next ENGINE_load_builtin_engines ENGINE_register_all_complete ENGINE_set_default ERR_clear_error ERR_error_string ERR_get_error ERR_load_strings ERR_peek_error ERR_put_error EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_free EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_key_length EVP_CIPHER_block_size EVP_CIPHER_flags EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_nid EVP_CipherFinal EVP_CipherInit EVP_CipherInit_ex EVP_CipherUpdate EVP_Digest EVP_DigestFinal EVP_DigestInit EVP_DigestUpdate EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_new EVP_MD_CTX_reset EVP_MD_size EVP_MD_type EVP_PKEY_free EVP_PKEY_get0_DSA EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_id EVP_get_cipherbyname EVP_get_digestbyname EVP_sha1 EVP_sha256 HMAC_CTX_free HMAC_CTX_new HMAC_CTX_reset HMAC_Final HMAC_Init_ex HMAC_Update HMAC_size OBJ_nid2sn OBJ_obj2nid OBJ_obj2txt OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OPENSSL_init_crypto OPENSSL_sk_delete OPENSSL_sk_find OPENSSL_sk_new OPENSSL_sk_num OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_value OpenSSL_version PEM_X509_INFO_read_bio PEM_read_bio_DHparams PEM_read_bio_PrivateKey PEM_read_bio_X509 PEM_read_bio_X509_CRL PEM_write_X509 PKCS12_free PKCS12_parse RAND_bytes RSA_bits RSA_flags RSA_free RSA_get0_key RSA_get_method RSA_meth_free RSA_meth_get0_app_data RSA_meth_new RSA_meth_set0_app_data RSA_meth_set_finish RSA_meth_set_init RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_meth_set_pub_dec RSA_meth_set_pub_enc RSA_new RSA_set0_key RSA_set_flags RSA_set_method RSA_size X509V3_EXT_print X509_CRL_free X509_INFO_free X509_LOOKUP_ctrl X509_LOOKUP_hash_dir X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_cmp X509_NAME_dup X509_NAME_entry_count X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_oneline X509_NAME_print_ex X509_OBJECT_free X509_OBJECT_get_type X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_ex_data X509_STORE_add_cert X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_get0_objects X509_STORE_set_flags X509_check_purpose X509_cmp_time X509_digest X509_free X509_get0_pubkey X509_get_ext X509_get_ext_by_NID X509_get_ext_d2i X509_get_pubkey X509_get_serialNumber X509_get_subject_name X509_getm_notAfter X509_getm_notBefore X509_verify_cert_error_string d2i_PKCS12_bio d2i_PKCS12_fp d2i_X509 i2a_ASN1_INTEGER

liblzo2-2

__lzo_init_v2 lzo1x_1_15_compress lzo1x_decompress_safe lzo_version_string

libpkcs11-helper-1

pkcs11h_addProvider pkcs11h_certificate_create pkcs11h_certificate_deserializeCertificateId pkcs11h_certificate_enumCertificateIds pkcs11h_certificate_freeCertificate pkcs11h_certificate_freeCertificateId pkcs11h_certificate_freeCertificateIdList pkcs11h_certificate_getCertificateBlob pkcs11h_certificate_serializeCertificateId pkcs11h_engine_setSystem pkcs11h_getMessage pkcs11h_initialize pkcs11h_logout pkcs11h_openssl_createSession pkcs11h_openssl_freeSession pkcs11h_openssl_getX509 pkcs11h_openssl_session_getEVP pkcs11h_openssl_session_getX509 pkcs11h_setForkMode pkcs11h_setLogHook pkcs11h_setLogLevel pkcs11h_setPINCachePeriod pkcs11h_setPINPromptHook pkcs11h_setProtectedAuthentication pkcs11h_setTokenPromptHook pkcs11h_terminate

libssl-1_1

BIO_f_ssl OPENSSL_init_ssl SSL_CIPHER_get_name SSL_CIPHER_get_version SSL_CTX_add_client_CA SSL_CTX_check_private_key SSL_CTX_ctrl SSL_CTX_free SSL_CTX_get0_certificate SSL_CTX_get_cert_store SSL_CTX_get_default_passwd_cb SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_new SSL_CTX_set_cipher_list SSL_CTX_set_client_CA_list SSL_CTX_set_default_passwd_cb SSL_CTX_set_info_callback SSL_CTX_set_options SSL_CTX_set_security_level SSL_CTX_set_verify SSL_CTX_use_PrivateKey SSL_CTX_use_RSAPrivateKey SSL_CTX_use_certificate SSL_alert_desc_string_long SSL_alert_type_string_long SSL_export_keying_material SSL_free SSL_get_cipher_list SSL_get_current_cipher SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_peer_certificate SSL_get_version SSL_new SSL_set_accept_state SSL_set_bio SSL_set_connect_state SSL_set_ex_data SSL_state_string_long TLS_client_method TLS_method TLS_server_method

advapi32

CryptCreateHash CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptSetHashParam CryptSignHashA InitializeSecurityDescriptor RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW SetKernelObjectSecurity SetSecurityDescriptorDacl

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CryptAcquireCertificatePrivateKey

fwpuclnt

FwpmEngineClose0 FwpmEngineOpen0 FwpmFilterAdd0 FwpmFreeMemory0 FwpmGetAppIdFromFileName0 FwpmSubLayerAdd0 FwpmSubLayerGetByKey0

iphlpapi

AddIPAddress ConvertInterfaceIndexToLuid CreateIpForwardEntry DeleteIPAddress DeleteIpForwardEntry FlushIpNetTable GetAdapterIndex GetAdaptersInfo GetBestInterfaceEx GetBestRoute2 GetInterfaceInfo GetIpForwardTable GetIpInterfaceEntry GetPerAdapterInfo InitializeIpInterfaceEntry IpReleaseAddress IpRenewAddress SetIpInterfaceEntry

kernel32

CancelIo CloseHandle CreateEventA CreateFileA CreateFileW CreateProcessA CreateProcessW CreateSemaphoreA DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FormatMessageA FormatMessageW FreeLibrary GetConsoleMode GetConsoleTitleA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileType GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetNumberOfConsoleInputEvents GetOverlappedResult GetProcAddress GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeZoneInformation InitializeCriticalSection IsWow64Process LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter ReadConsoleInputA ReadConsoleW ReadFile ReleaseSemaphore ResetEvent SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetConsoleTitleA SetEvent SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleInputA WriteFile

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _chsize _dup2 _errno _exit _fdopen _fmode _initterm _iob _lock _onexit _open_osfhandle _snwprintf _stricmp _strnicmp calloc ctime exit fclose fflush fgetc fgets fopen fprintf fputc free fwprintf fwrite isalnum isalpha iscntrl isprint ispunct isspace isxdigit malloc mbstowcs memcmp memcpy memmove memset printf putchar puts qsort raise rand realloc setlocale signal srand sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strrchr strstr strtok strtol _unlock _vsnwprintf _waccess _wchdir _wcmdln _wfopen _wopen _wstat abort atoi time tolower toupper vfprintf wcscpy wcstombs _vsnprintf _write _strdup _read _open _lseek _dup2 _dup _close

ncrypt

NCryptFreeObject NCryptSignHash

user32

MessageBoxW

ws2_32

WSACleanup WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSAStartup WSAWaitForMultipleEvents accept bind closesocket connect freeaddrinfo getaddrinfo getnameinfo getservbyname getsockname getsockopt htonl htons inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv select send setsockopt socket

Name

.text

Size

662KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

protected_elam/amd64/protected_elam.sys

IMPHASH 293190b331b17091579cb7083407b852
SHA256 9438aef3972f0f7ed7defde896041d3a98c9d12b102fb6c77abc5daa70cdb5df
MD5 9bee915715ccabb945154f4706f49325
SHA1 0fe18efb4572a24d1d744b99a0466c43643416a0
SHA512 6d84609c3dd868d5823d5da8a6d06ec20728aa1054cb0f2994e4766df95bb37343f72d46e6f5894b5e2bb2239224220620073d29f13aa041922b899c5b8486b7
SSDEEP 192:+GCPcD0OWk7GszrmY8uiW7JTHmVWQ4mWX3T0yjpC52qnajWdUcZ:+GUcDwQmYtZHm8Nlla
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

ad:b1:63:a3:1d:c7:34:d8:cf:b0:f0:4a:6c:59:c2:d4:06:4c:54:97:b5:4d:27:6e:af:9d:c4:d8:ed:35:b4:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

4272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\repos\protected_elam\protected_elam\x64\Release\protected_elam.pdb

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

654B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

protected_elam/x86/protected_elam.sys

IMPHASH 293190b331b17091579cb7083407b852
SHA256 02326a506a80d90e819048740da8f88cf6eac0e5a17f6c91652121ce46da4b41
MD5 c9c8eabfe8428423bdb397369247f48b
SHA1 da592a7d2f108356da9e87b06fa285a1a0422cfc
SHA512 8b7ee0de9756ba2d3b38c5a792b19c068052234cd02b5613d4abb21c8b02a8b4e9a18b5f4e7050ffcf186cb75f7929007fd4d4b68dbc77772557f684e21d0e86
SSDEEP 192:EQ/MVnhyp3D+TyQRePyjBK1MGmY8zGW7JTHmVWQ4mW5EnOk9qnajrEIgCq:EQ/MVnhyp3DiyQUPdmYMlHmvhlvEFn
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

41:49:7e:e3:f6:08:ea:25:a6:ef:8b:63:f2:e9:b5:99:27:ad:3c:6b:2d:84:2e:c2:60:09:98:2b:f4:04:78:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

10

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\protected_elam\protected_elam\Release\protected_elam.pdb

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

908B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1024B

Virtual Size

526B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

pwm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4785ea7b53ac4790be8c24e8bac66784e4e8cae59ea5c9c6395b6a919b20ad26
MD5 b2d3abd532b29cf84d97f67306bd2377
SHA1 58ff1f983418f913b483b95e46d63c4bcb943821
SHA512 280eafa6bb44b19afec716455bc9287961c2f471d5c2c597c20bf25eb5b69d2863a97bf271a4c3eaad6ce6a67082d686904a87bd35457a7cf7c92f04f84a340e
SSDEEP 768:+ymFTYsH+5FUraxpcn0CLRGgFxZZjQZ9XIjFDqrDsUn5E:AH+5FUrfbAojQZ9XIjRqrYW+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

securityservice.cat

SHA256 c62d02241d2a2a5c973d093a3c73082c2b617ea504e4b132990744c0db641e90
MD5 1c8bd407b39133cbbb76d4f8db01ae39
SHA1 87681f948f0c664382e57e8a26c47cbb3fea00bf
SHA512 fc6edf56e3ce016b5d8ea410d902b010eb6c5ec11707f209926fbae3164c617ed6d6a4328440291a68a2d4d3239244b96dbbfd6e754b250d475b5afd682704d7
SSDEEP 24576:YJa0X1ipyIp6R5PkJruvo0JxJ2Xvdw+v8bIyAT5XZwUQY:wZIpwPkkroXlws8byPw2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

sni.dll

IMPHASH 00f5001ebf137746556043a7c9155eca
SHA256 1446d6b26da49a5a9f366972f89f4e236f916955f31ddc38ebb96217c1cace9c
MD5 c62a83f20bc23aeface70ec13003c4c5
SHA1 35553cfcdcbeccdc49710e68aec495c16880f0bd
SHA512 4dda44fd5b538f5da9e8cb46a3ab1bdc14b43425b9a61249eccc925d986af7b8b3548db9490238f14807909ecf479415117141ddb344119438a59f97e894ea37
SSDEEP 3072:H3SGhrfrdqCn3bctzdGRX18u5e++dowahamD5/f+vHPoW:H3SGhbBqCnmzERyiepSUm9moW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

be:e0:1f:b9:15:bc:e5:77:a2:a0:e3:dd:41:4e:59:93:c8:28:3b:1c:91:bd:9d:1c:42:fa:96:2c:4e:9a:f0:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

a4:da:98:d6:cc:38:31:14:3a:60:44:18:10:f5:a7:26:00:cf:81:f1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 12, 2017

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 17, 2016 - Feb 17, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

70512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\A\_work\410\s\bin\obj\Windows_NT.x86.Release\Native\sni\Release\sni.pdb

kernel32

SetEvent CreateSemaphoreA SetLastError GetQueuedCompletionStatus Sleep FileTimeToSystemTime GetSystemDirectoryA CreateThread SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime InitializeSListHead CreateIoCompletionPort GetComputerNameA TlsSetValue FormatMessageW TlsAlloc WaitForMultipleObjects TlsFree SetHandleInformation LoadLibraryExW InitializeCriticalSectionAndSpinCount ReleaseSemaphore MultiByteToWideChar GetComputerNameExA WideCharToMultiByte CompareStringA LCMapStringA SetFileCompletionNotificationModes GetTickCount GetOverlappedResult CreateFileA DisconnectNamedPipe WaitForSingleObject PeekNamedPipe WriteFile GetCurrentProcess WaitNamedPipeA SetNamedPipeHandleState ReadFile QueryDepthSList InterlockedPopEntrySList CreateEventA InterlockedPushEntrySList RtlUnwind RaiseException IsDebuggerPresent GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeLibrary DeleteCriticalSection GetProcAddress CloseHandle LoadLibraryA InterlockedFlushSList GetLastError PostQueuedCompletionStatus InitializeCriticalSection LeaveCriticalSection TlsGetValue EnterCriticalSection

user32

CharNextExA

advapi32

RegCloseKey ImpersonateNamedPipeClient CryptDestroyKey CryptReleaseContext IsTokenRestricted RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumKeyExA RevertToSelf

rpcrt4

UuidCreate

ws2_32

WSAIoctl WSASend getpeername getsockname ntohs shutdown bind WSARecv WSAPoll getnameinfo WSACleanup __WSAFDIsSet closesocket select WSAEnumProtocolsW connect WSAGetLastError setsockopt sendto freeaddrinfo htons htonl socket WSAStartup getaddrinfo WSAStringToAddressW recv

api-ms-win-crt-string-l1-1-0

_wcsnicmp _stricmp strcpy_s strncmp _stricmp_l wcsncpy_s _strnicmp_l

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

_atoi_l atoi

api-ms-win-crt-multibyte-l1-1-0

_mbsnbicmp_l _mbschr _mbsspn

api-ms-win-crt-runtime-l1-1-0

_cexit abort _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment terminate _invalid_parameter_noinfo _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _errno

api-ms-win-crt-heap-l1-1-0

_calloc_base _callnewh free malloc _free_base

ucrtbase.dll

IMPHASH e97d8949b62ac66aa0d4cfccf17c8a2e
SHA256 6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
MD5 6343ff7874ba03f78bb0dfe20b45f817
SHA1 82221a9ac1c1b8006f3f5e8539e74e3308f10bcb
SHA512 63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994
SSDEEP 24576:Os974wcfeCepgb9qqu+XMO4nXIzvQVbe1SmcvIZPoy4/ZBVX:b96WghMOqI8Vbe1GZBVX
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

30:aa:01:6d:b0:35:c9:61:c8:d9:c3:fe:74:38:8e:42:06:ff:c6:fb:86:9d:17:2d:bb:49:99:de:0f:db:71:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

PE Signature issue

Digest

7e:11:3c:29:b8:de:a4:9c:00:ae:7e:79:e2:be:8d:21:f4:00:84:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

196768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ucrtbase.pdb

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter SetErrorMode RaiseException GetLastError SetLastError

api-ms-win-core-heap-l1-1-0

HeapSize HeapAlloc HeapCompact HeapValidate HeapReAlloc HeapQueryInformation GetProcessHeap HeapWalk HeapFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread GetCurrentProcess TlsAlloc TerminateProcess TlsSetValue GetCurrentThreadId TlsGetValue ExitProcess TlsFree GetCurrentProcessId GetExitCodeProcess ResumeThread ExitThread CreateThread CreateProcessW GetStartupInfoW

api-ms-win-core-file-l1-1-0

WriteFile GetDiskFreeSpaceW GetLogicalDrives SetFileTime SetFilePointerEx LockFileEx UnlockFileEx FlushFileBuffers SetEndOfFile DeleteFileW RemoveDirectoryW CreateDirectoryW SetFileAttributesW GetFileAttributesExW GetDriveTypeW GetFileInformationByHandle GetFullPathNameW FindFirstFileExW CreateFileW FindNextFileW ReadFile GetFileType FindClose

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW FreeLibrary GetModuleHandleExW GetModuleFileNameW GetProcAddress LoadLibraryExW FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

EnterCriticalSection LeaveCriticalSection WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionAndSpinCount

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW GetStdHandle GetCommandLineA FreeEnvironmentStringsW SetCurrentDirectoryW SetEnvironmentVariableW GetCommandLineW GetCurrentDirectoryW SetStdHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar GetStringTypeW CompareStringW WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID GetCPInfo GetACP IsValidCodePage GetLocaleInfoW LCMapStringW EnumSystemLocalesW IsValidLocale GetOEMCP

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetLocalTime SetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

ReadConsoleInputW SetConsoleCtrlHandler WriteConsoleW GetConsoleCP SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleW PeekConsoleInputA GetConsoleMode

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation FileTimeToSystemTime TzSpecificLocalTimeToSystemTime

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualQuery VirtualProtect

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer Beep

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList InterlockedPushEntrySList

_CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _Cbuild _Cmulcc _Cmulcr _CreateFrameInfo _CxxThrowException _EH_prolog _Exit _FCbuild _FCmulcc _FCmulcr _FindAndUnlinkFrame _Getdays _Getmonths _Gettnames _IsExceptionObjectToBeDestroyed _LCbuild _LCmulcc _LCmulcr _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback _Strftime _W_Getdays _W_Getmonths _W_Gettnames _Wcsftime __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func ___mb_cur_max_func ___mb_cur_max_l_func __acrt_iob_func __conio_common_vcprintf __conio_common_vcprintf_p __conio_common_vcprintf_s __conio_common_vcscanf __conio_common_vcwprintf __conio_common_vcwprintf_p __conio_common_vcwprintf_s __conio_common_vcwscanf __control87_2 __current_exception __current_exception_context __daylight __dcrt_get_wide_environment_from_os __dcrt_initial_narrow_environment __doserrno __dstbias __fpe_flt_rounds __fpecode __initialize_lconv_for_unsigned_char __intrinsic_abnormal_termination __intrinsic_setjmp __isascii __iscsym __iscsymf __iswcsym __iswcsymf __libm_sse2_acos __libm_sse2_acosf __libm_sse2_asin __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_atanf __libm_sse2_cos __libm_sse2_cosf __libm_sse2_exp __libm_sse2_expf __libm_sse2_log __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_logf __libm_sse2_pow __libm_sse2_powf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_tan __libm_sse2_tanf __p___argc __p___argv __p___wargv __p__acmdln __p__commode __p__environ __p__fmode __p__mbcasemap __p__mbctype __p__pgmptr __p__wcmdln __p__wenviron __p__wpgmptr __pctype_func __processing_throw __pwctype_func __pxcptinfoptrs __report_gsfailure __setusermatherr __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __stdio_common_vfprintf __stdio_common_vfprintf_p __stdio_common_vfprintf_s __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vfwprintf_p __stdio_common_vfwprintf_s __stdio_common_vfwscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_p __stdio_common_vswprintf_s __stdio_common_vswscanf __strncnt __sys_errlist __sys_nerr __threadhandle __threadid __timezone __toascii __tzname __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __wcserror __wcserror_s __wcsncnt _abs64 _access _access_s _aligned_free _aligned_malloc _aligned_msize _aligned_offset_malloc _aligned_offset_realloc _aligned_offset_recalloc _aligned_realloc _aligned_recalloc _assert _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _beep _beginthread _beginthreadex _byteswap_uint64 _byteswap_ulong _byteswap_ushort _c_exit _cabs _callnewh _calloc_base _cexit _cgets _cgets_s _cgetws _cgetws_s _chdir _chdrive _chgsign _chgsignf _chkesp _chmod _chsize _chsize_s _clearfp _close _commit _configthreadlocale _configure_narrow_argv _configure_wide_argv _control87 _controlfp _controlfp_s _copysign _copysignf _cputs _cputws _creat _create_locale _crt_at_quick_exit _crt_atexit _crt_debugger_hook _ctime32 _ctime32_s _ctime64 _ctime64_s _cwait _d_int _dclass _dexp _difftime32 _difftime64 _dlog _dnorm _dpcomp _dpoly _dscale _dsign _dsin _dtest _dunscale _dup _dup2 _dupenv_s _ecvt _ecvt_s _endthread _endthreadex _eof _errno _except1 _except_handler2 _except_handler3 _except_handler4_common _execl _execle _execlp _execlpe _execute_onexit_table _execv _execve _execvp _execvpe _exit _expand _fclose_nolock _fcloseall _fcvt _fcvt_s _fd_int _fdclass _fdexp _fdlog _fdnorm _fdopen _fdpcomp _fdpoly _fdscale _fdsign _fdsin _fdtest _fdunscale _fflush_nolock _fgetc_nolock _fgetchar _fgetwc_nolock _fgetwchar _filelength _filelengthi64 _fileno _findclose _findfirst32 _findfirst32i64 _findfirst64 _findfirst64i32 _findnext32 _findnext32i64 _findnext64 _findnext64i32 _finite _flushall _fpclass _fpieee_flt _fpreset _fputc_nolock _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _free_base _free_locale _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _fstat32 _fstat32i64 _fstat64 _fstat64i32 _ftell_nolock _ftelli64 _ftelli64_nolock _ftime32 _ftime32_s _ftime64 _ftime64_s _ftol _fullpath _futime32 _futime64 _fwrite_nolock _gcvt _gcvt_s _get_current_locale _get_daylight _get_doserrno _get_dstbias _get_errno _get_fmode _get_heap_handle _get_initial_narrow_environment _get_initial_wide_environment _get_invalid_parameter_handler _get_narrow_winmain_command_line _get_osfhandle _get_pgmptr _get_printf_count_output _get_purecall_handler _get_stream_buffer_pointers _get_terminate _get_thread_local_invalid_parameter_handler _get_timezone _get_tzname _get_unexpected _get_wide_winmain_command_line _get_wpgmptr _getc_nolock _getch _getch_nolock _getche _getche_nolock _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwc_nolock _getwch _getwch_nolock _getwche _getwche_nolock _getws _getws_s _global_unwind2 _gmtime32 _gmtime32_s _gmtime64 _gmtime64_s _heapchk _heapmin _heapwalk _hypot _hypotf _i64toa _i64toa_s _i64tow _i64tow_s _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _is_exception_typeof _isalnum_l _isalpha_l _isatty _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _isnan _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _itoa _itoa_s _itow _itow_s _j0 _j1 _jn _kbhit _ld_int _ldclass _ldexp _ldlog _ldpcomp _ldpoly _ldscale _ldsign _ldsin _ldtest _ldunscale _lfind _lfind_s _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _loaddll _local_unwind2 _local_unwind4 _localtime32 _localtime32_s _localtime64 _localtime64_s _lock_file _lock_locales _locking _logb _longjmpex _lrotl _lrotr _lsearch _lsearch_s _lseek _lseeki64 _ltoa _ltoa_s _ltow _ltow_s _makepath _makepath_s _malloc_base _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsdup _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l _memccpy _memicmp _memicmp_l _mkdir _mkgmtime32 _mkgmtime64 _mktemp _mktemp_s _mktime32 _mktime64 _msize _nextafter _o__CIacos _o__CIasin _o__CIatan _o__CIatan2 _o__CIcos _o__CIcosh _o__CIexp _o__CIfmod _o__CIlog _o__CIlog10 _o__CIpow _o__CIsin _o__CIsinh _o__CIsqrt _o__CItan _o__CItanh _o__Getdays _o__Getmonths _o__Gettnames _o__Strftime _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__Wcsftime _o____lc_codepage_func _o____lc_collate_cp_func _o____lc_locale_name_func _o____mb_cur_max_func _o___acrt_iob_func _o___conio_common_vcprintf _o___conio_common_vcprintf_p _o___conio_common_vcprintf_s _o___conio_common_vcscanf _o___conio_common_vcwprintf _o___conio_common_vcwprintf_p _o___conio_common_vcwprintf_s _o___conio_common_vcwscanf _o___daylight _o___dstbias _o___fpe_flt_rounds _o___libm_sse2_acos _o___libm_sse2_acosf _o___libm_sse2_asin _o___libm_sse2_asinf _o___libm_sse2_atan _o___libm_sse2_atan2 _o___libm_sse2_atanf _o___libm_sse2_cos _o___libm_sse2_cosf _o___libm_sse2_exp _o___libm_sse2_expf _o___libm_sse2_log _o___libm_sse2_log10 _o___libm_sse2_log10f _o___libm_sse2_logf _o___libm_sse2_pow _o___libm_sse2_powf _o___libm_sse2_sin _o___libm_sse2_sinf _o___libm_sse2_tan _o___libm_sse2_tanf _o___p___argc _o___p___argv _o___p___wargv _o___p__acmdln _o___p__commode _o___p__environ _o___p__fmode _o___p__mbcasemap _o___p__mbctype _o___p__pgmptr _o___p__wcmdln _o___p__wenviron _o___p__wpgmptr _o___pctype_func _o___pwctype_func _o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___std_type_info_name _o___stdio_common_vfprintf _o___stdio_common_vfprintf_p _o___stdio_common_vfprintf_s _o___stdio_common_vfscanf _o___stdio_common_vfwprintf _o___stdio_common_vfwprintf_p _o___stdio_common_vfwprintf_s _o___stdio_common_vfwscanf _o___stdio_common_vsnprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsprintf_p _o___stdio_common_vsprintf_s _o___stdio_common_vsscanf _o___stdio_common_vswprintf _o___stdio_common_vswprintf_p _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o___timezone _o___tzname _o___wcserror _o__access _o__access_s _o__aligned_free _o__aligned_malloc _o__aligned_msize _o__aligned_offset_malloc _o__aligned_offset_realloc _o__aligned_offset_recalloc _o__aligned_realloc _o__aligned_recalloc _o__atodbl _o__atodbl_l _o__atof_l _o__atoflt _o__atoflt_l _o__atoi64 _o__atoi64_l _o__atoi_l _o__atol_l _o__atoldbl _o__atoldbl_l _o__atoll_l _o__beep _o__beginthread _o__beginthreadex _o__cabs _o__callnewh _o__calloc_base _o__cexit _o__cgets _o__cgets_s _o__cgetws _o__cgetws_s _o__chdir _o__chdrive _o__chmod _o__chsize _o__chsize_s _o__close _o__commit _o__configthreadlocale _o__configure_narrow_argv _o__configure_wide_argv _o__controlfp_s _o__cputs _o__cputws _o__creat _o__create_locale _o__crt_atexit _o__ctime32_s _o__ctime64_s _o__cwait _o__d_int _o__dclass _o__difftime32 _o__difftime64 _o__dlog _o__dnorm _o__dpcomp _o__dpoly _o__dscale _o__dsign _o__dsin _o__dtest _o__dunscale _o__dup _o__dup2 _o__dupenv_s _o__ecvt _o__ecvt_s _o__endthread _o__endthreadex _o__eof _o__errno _o__except1 _o__execute_onexit_table _o__execv _o__execve _o__execvp _o__execvpe _o__exit _o__expand _o__fclose_nolock _o__fcloseall _o__fcvt _o__fcvt_s _o__fd_int _o__fdclass _o__fdexp _o__fdlog _o__fdopen _o__fdpcomp _o__fdpoly _o__fdscale _o__fdsign _o__fdsin _o__fflush_nolock _o__fgetc_nolock _o__fgetchar _o__fgetwc_nolock _o__fgetwchar _o__filelength _o__filelengthi64 _o__fileno _o__findclose _o__findfirst32 _o__findfirst32i64 _o__findfirst64 _o__findfirst64i32 _o__findnext32 _o__findnext32i64 _o__findnext64 _o__findnext64i32 _o__flushall _o__fpclass _o__fputc_nolock _o__fputchar _o__fputwc_nolock _o__fputwchar _o__fread_nolock _o__fread_nolock_s _o__free_base _o__free_locale _o__fseek_nolock _o__fseeki64 _o__fseeki64_nolock _o__fsopen _o__fstat32 _o__fstat32i64 _o__fstat64 _o__fstat64i32 _o__ftell_nolock _o__ftelli64 _o__ftelli64_nolock _o__ftime32 _o__ftime32_s _o__ftime64 _o__ftime64_s _o__fullpath _o__futime32 _o__futime64 _o__fwrite_nolock _o__gcvt _o__gcvt_s _o__get_daylight _o__get_doserrno _o__get_dstbias _o__get_errno _o__get_fmode _o__get_heap_handle _o__get_initial_narrow_environment _o__get_initial_wide_environment _o__get_invalid_parameter_handler _o__get_narrow_winmain_command_line _o__get_osfhandle _o__get_pgmptr _o__get_stream_buffer_pointers _o__get_terminate _o__get_thread_local_invalid_parameter_handler _o__get_timezone _o__get_tzname _o__get_wide_winmain_command_line _o__get_wpgmptr _o__getc_nolock _o__getch _o__getch_nolock _o__getche _o__getche_nolock _o__getcwd _o__getdcwd _o__getdiskfree _o__getdllprocaddr _o__getdrive _o__getdrives _o__getmbcp _o__getsystime _o__getw _o__getwc_nolock _o__getwch _o__getwch_nolock _o__getwche _o__getwche_nolock _o__getws _o__getws_s _o__gmtime32 _o__gmtime32_s _o__gmtime64 _o__gmtime64_s _o__heapchk _o__heapmin _o__hypot _o__hypotf _o__i64toa _o__i64toa_s _o__i64tow _o__i64tow_s _o__initialize_narrow_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__isatty _o__isctype _o__isctype_l _o__isleadbyte_l _o__ismbbalnum _o__ismbbalnum_l _o__ismbbalpha _o__ismbbalpha_l _o__ismbbblank _o__ismbbblank_l _o__ismbbgraph _o__ismbbgraph_l _o__ismbbkalnum _o__ismbbkalnum_l _o__ismbbkana _o__ismbbkana_l _o__ismbbkprint _o__ismbbkprint_l _o__ismbbkpunct _o__ismbbkpunct_l _o__ismbblead _o__ismbblead_l _o__ismbbprint _o__ismbbprint_l _o__ismbbpunct _o__ismbbpunct_l _o__ismbbtrail _o__ismbbtrail_l _o__ismbcalnum _o__ismbcalnum_l _o__ismbcalpha _o__ismbcalpha_l _o__ismbcblank _o__ismbcblank_l _o__ismbcdigit _o__ismbcdigit_l _o__ismbcgraph _o__ismbcgraph_l _o__ismbchira _o__ismbchira_l _o__ismbckata _o__ismbckata_l _o__ismbcl0 _o__ismbcl0_l _o__ismbcl1 _o__ismbcl1_l _o__ismbcl2 _o__ismbcl2_l _o__ismbclegal _o__ismbclegal_l _o__ismbclower _o__ismbclower_l _o__ismbcprint _o__ismbcprint_l _o__ismbcpunct _o__ismbcpunct_l _o__ismbcspace _o__ismbcspace_l _o__ismbcsymbol _o__ismbcsymbol_l _o__ismbcupper _o__ismbcupper_l _o__ismbslead _o__ismbslead_l _o__ismbstrail _o__ismbstrail_l _o__iswctype_l _o__itoa _o__itoa_s _o__itow _o__itow_s _o__j0 _o__j1 _o__jn _o__kbhit _o__ld_int _o__ldclass _o__ldexp _o__ldlog _o__ldpcomp _o__ldpoly _o__ldscale _o__ldsign _o__ldsin _o__ldtest _o__ldunscale _o__lfind _o__lfind_s _o__libm_sse2_acos_precise _o__libm_sse2_asin_precise _o__libm_sse2_atan_precise _o__libm_sse2_cos_precise _o__libm_sse2_exp_precise _o__libm_sse2_log10_precise _o__libm_sse2_log_precise _o__libm_sse2_pow_precise _o__libm_sse2_sin_precise _o__libm_sse2_sqrt_precise _o__libm_sse2_tan_precise _o__loaddll _o__localtime32 _o__localtime32_s _o__localtime64 _o__localtime64_s _o__lock_file _o__locking _o__logb _o__lsearch _o__lsearch_s _o__lseek _o__lseeki64 _o__ltoa _o__ltoa_s _o__ltow _o__ltow_s _o__makepath _o__makepath_s _o__malloc_base _o__mbbtombc _o__mbbtombc_l _o__mbbtype _o__mbbtype_l _o__mbccpy _o__mbccpy_l _o__mbccpy_s _o__mbccpy_s_l _o__mbcjistojms _o__mbcjistojms_l _o__mbcjmstojis _o__mbcjmstojis_l _o__mbclen _o__mbclen_l _o__mbctohira _o__mbctohira_l _o__mbctokata _o__mbctokata_l _o__mbctolower _o__mbctolower_l _o__mbctombb _o__mbctombb_l _o__mbctoupper _o__mbctoupper_l _o__mblen_l _o__mbsbtype _o__mbsbtype_l _o__mbscat_s _o__mbscat_s_l _o__mbschr _o__mbschr_l _o__mbscmp _o__mbscmp_l _o__mbscoll _o__mbscoll_l _o__mbscpy_s _o__mbscpy_s_l _o__mbscspn _o__mbscspn_l _o__mbsdec _o__mbsdec_l _o__mbsicmp _o__mbsicmp_l _o__mbsicoll _o__mbsicoll_l _o__mbsinc _o__mbsinc_l _o__mbslen _o__mbslen_l _o__mbslwr _o__mbslwr_l _o__mbslwr_s _o__mbslwr_s_l _o__mbsnbcat _o__mbsnbcat_l _o__mbsnbcat_s _o__mbsnbcat_s_l _o__mbsnbcmp _o__mbsnbcmp_l _o__mbsnbcnt _o__mbsnbcnt_l _o__mbsnbcoll _o__mbsnbcoll_l _o__mbsnbcpy _o__mbsnbcpy_l _o__mbsnbcpy_s _o__mbsnbcpy_s_l _o__mbsnbicmp _o__mbsnbicmp_l _o__mbsnbicoll _o__mbsnbicoll_l _o__mbsnbset _o__mbsnbset_l _o__mbsnbset_s _o__mbsnbset_s_l _o__mbsncat _o__mbsncat_l _o__mbsncat_s _o__mbsncat_s_l _o__mbsnccnt _o__mbsnccnt_l _o__mbsncmp _o__mbsncmp_l _o__mbsncoll _o__mbsncoll_l _o__mbsncpy _o__mbsncpy_l _o__mbsncpy_s _o__mbsncpy_s_l _o__mbsnextc _o__mbsnextc_l _o__mbsnicmp _o__mbsnicmp_l _o__mbsnicoll _o__mbsnicoll_l _o__mbsninc _o__mbsninc_l _o__mbsnlen _o__mbsnlen_l _o__mbsnset _o__mbsnset_l _o__mbsnset_s _o__mbsnset_s_l _o__mbspbrk _o__mbspbrk_l _o__mbsrchr _o__mbsrchr_l _o__mbsrev _o__mbsrev_l _o__mbsset _o__mbsset_l _o__mbsset_s _o__mbsset_s_l _o__mbsspn _o__mbsspn_l _o__mbsspnp _o__mbsspnp_l _o__mbsstr _o__mbsstr_l _o__mbstok _o__mbstok_l _o__mbstok_s _o__mbstok_s_l _o__mbstowcs_l _o__mbstowcs_s_l _o__mbstrlen _o__mbstrlen_l _o__mbstrnlen _o__mbstrnlen_l _o__mbsupr _o__mbsupr_l _o__mbsupr_s _o__mbsupr_s_l _o__mbtowc_l _o__memicmp _o__memicmp_l _o__mkdir _o__mkgmtime32 _o__mkgmtime64 _o__mktemp _o__mktemp_s _o__mktime32 _o__mktime64 _o__msize _o__nextafter _o__open_osfhandle _o__pclose _o__pipe _o__popen _o__purecall _o__putc_nolock _o__putch _o__putch_nolock _o__putenv _o__putenv_s _o__putw _o__putwc_nolock _o__putwch _o__putwch_nolock _o__putws _o__read _o__realloc_base _o__recalloc _o__register_onexit_function _o__resetstkoflw _o__rmdir _o__rmtmp _o__scalb _o__searchenv _o__searchenv_s _o__seh_filter_dll _o__seh_filter_exe _o__set_abort_behavior _o__set_app_type _o__set_doserrno _o__set_errno _o__set_fmode _o__set_invalid_parameter_handler _o__set_new_handler _o__set_new_mode _o__set_thread_local_invalid_parameter_handler _o__seterrormode _o__setmbcp _o__setmode _o__setsystime _o__sleep _o__sopen _o__sopen_dispatch _o__sopen_s _o__spawnv _o__spawnve _o__spawnvp _o__spawnvpe _o__splitpath _o__splitpath_s _o__stat32 _o__stat32i64 _o__stat64 _o__stat64i32 _o__strcoll_l _o__strdate _o__strdate_s _o__strdup _o__strerror _o__strerror_s _o__strftime_l _o__stricmp _o__stricmp_l _o__stricoll _o__stricoll_l _o__strlwr _o__strlwr_l _o__strlwr_s _o__strlwr_s_l _o__strncoll _o__strncoll_l _o__strnicmp _o__strnicmp_l _o__strnicoll _o__strnicoll_l _o__strnset_s _o__strset_s _o__strtime _o__strtime_s _o__strtod_l _o__strtof_l _o__strtoi64 _o__strtoi64_l _o__strtol_l _o__strtold_l _o__strtoll_l _o__strtoui64 _o__strtoui64_l _o__strtoul_l _o__strtoull_l _o__strupr _o__strupr_l _o__strupr_s _o__strupr_s_l _o__strxfrm_l _o__swab _o__tell _o__telli64 _o__timespec32_get _o__timespec64_get _o__tolower _o__tolower_l _o__toupper _o__toupper_l _o__towlower_l _o__towupper_l _o__tzset _o__ui64toa _o__ui64toa_s _o__ui64tow _o__ui64tow_s _o__ultoa _o__ultoa_s _o__ultow _o__ultow_s _o__umask _o__umask_s _o__ungetc_nolock _o__ungetch _o__ungetch_nolock _o__ungetwc_nolock _o__ungetwch _o__ungetwch_nolock _o__unlink _o__unloaddll _o__unlock_file _o__utime32 _o__utime64 _o__waccess _o__waccess_s _o__wasctime _o__wasctime_s _o__wchdir _o__wchmod _o__wcreat _o__wcreate_locale _o__wcscoll_l _o__wcsdup _o__wcserror _o__wcserror_s _o__wcsftime_l _o__wcsicmp _o__wcsicmp_l _o__wcsicoll _o__wcsicoll_l _o__wcslwr _o__wcslwr_l _o__wcslwr_s _o__wcslwr_s_l _o__wcsncoll _o__wcsncoll_l _o__wcsnicmp _o__wcsnicmp_l _o__wcsnicoll _o__wcsnicoll_l _o__wcsnset _o__wcsnset_s _o__wcsset _o__wcsset_s _o__wcstod_l _o__wcstof_l _o__wcstoi64 _o__wcstoi64_l _o__wcstol_l _o__wcstold_l _o__wcstoll_l _o__wcstombs_l _o__wcstombs_s_l _o__wcstoui64 _o__wcstoui64_l _o__wcstoul_l _o__wcstoull_l _o__wcsupr _o__wcsupr_l _o__wcsupr_s _o__wcsupr_s_l _o__wcsxfrm_l _o__wctime32 _o__wctime32_s _o__wctime64 _o__wctime64_s _o__wctomb_l _o__wctomb_s_l _o__wdupenv_s _o__wexecv _o__wexecve _o__wexecvp _o__wexecvpe _o__wfdopen _o__wfindfirst32 _o__wfindfirst32i64 _o__wfindfirst64 _o__wfindfirst64i32 _o__wfindnext32 _o__wfindnext32i64 _o__wfindnext64 _o__wfindnext64i32 _o__wfopen _o__wfopen_s _o__wfreopen _o__wfreopen_s _o__wfsopen _o__wfullpath _o__wgetcwd _o__wgetdcwd _o__wgetenv _o__wgetenv_s _o__wmakepath _o__wmakepath_s _o__wmkdir _o__wmktemp _o__wmktemp_s _o__wperror _o__wpopen _o__wputenv _o__wputenv_s _o__wremove _o__wrename _o__write _o__wrmdir _o__wsearchenv _o__wsearchenv_s _o__wsetlocale _o__wsopen_dispatch _o__wsopen_s _o__wspawnv _o__wspawnve _o__wspawnvp _o__wspawnvpe _o__wsplitpath _o__wsplitpath_s _o__wstat32 _o__wstat32i64 _o__wstat64 _o__wstat64i32 _o__wstrdate _o__wstrdate_s _o__wstrtime _o__wstrtime_s _o__wsystem _o__wtmpnam_s _o__wtof _o__wtof_l _o__wtoi _o__wtoi64 _o__wtoi64_l _o__wtoi_l _o__wtol _o__wtol_l _o__wtoll _o__wtoll_l _o__wunlink _o__wutime32 _o__wutime64 _o__y0 _o__y1 _o__yn _o_abort _o_acos _o_acosh _o_acoshf _o_acoshl _o_asctime _o_asctime_s _o_asin _o_asinh _o_asinhf _o_asinhl _o_atan _o_atan2 _o_atanh _o_atanhf _o_atanhl _o_atof _o_atoi _o_atol _o_atoll _o_bsearch _o_bsearch_s _o_btowc _o_calloc _o_cbrt _o_cbrtf _o_ceil _o_clearerr _o_clearerr_s _o_cos _o_cosh _o_erf _o_erfc _o_erfcf _o_erfcl _o_erff _o_erfl _o_exit _o_exp _o_exp2 _o_exp2f _o_exp2l _o_fabs _o_fclose _o_feof _o_ferror _o_fflush _o_fgetc _o_fgetpos _o_fgets _o_fgetwc _o_fgetws _o_floor _o_fma _o_fmaf _o_fmal _o_fmod _o_fopen _o_fopen_s _o_fputc _o_fputs _o_fputwc _o_fputws _o_fread _o_fread_s _o_free _o_freopen _o_freopen_s _o_frexp _o_fseek _o_fsetpos _o_ftell _o_fwrite _o_getc _o_getchar _o_getenv _o_getenv_s _o_gets _o_gets_s _o_getwc _o_getwchar _o_hypot _o_is_wctype _o_isalnum _o_isalpha _o_isblank _o_iscntrl _o_isdigit _o_isgraph _o_isleadbyte _o_islower _o_isprint _o_ispunct _o_isspace _o_isupper _o_iswalnum _o_iswalpha _o_iswascii _o_iswblank _o_iswcntrl _o_iswctype _o_iswdigit _o_iswgraph _o_iswlower _o_iswprint _o_iswpunct _o_iswspace _o_iswupper _o_iswxdigit _o_isxdigit _o_ldexp _o_lgamma _o_lgammaf _o_lgammal _o_llrint _o_llrintf _o_llrintl _o_llround _o_llroundf _o_llroundl _o_localeconv _o_log _o_log10 _o_log1p _o_log1pf _o_log1pl _o_log2 _o_log2f _o_log2l _o_logb _o_logbf _o_logbl _o_lrint _o_lrintf _o_lrintl _o_lround _o_lroundf _o_lroundl _o_malloc _o_mblen _o_mbrlen _o_mbrtoc16 _o_mbrtoc32 _o_mbrtowc _o_mbsrtowcs _o_mbsrtowcs_s _o_mbstowcs _o_mbstowcs_s _o_mbtowc _o_memcpy_s _o_memset _o_modf _o_nan _o_nanf _o_nanl _o_nearbyint _o_nearbyintf _o_nearbyintl _o_nextafter _o_nextafterf _o_nextafterl _o_nexttoward _o_nexttowardf _o_nexttowardl _o_pow _o_powf _o_putc _o_putchar _o_puts _o_putwc _o_putwchar _o_qsort _o_qsort_s _o_raise _o_rand _o_rand_s _o_realloc _o_remainder _o_remainderf _o_remainderl _o_remove _o_remquo _o_remquof _o_remquol _o_rename _o_rewind _o_rint _o_rintf _o_rintl _o_round _o_roundf _o_roundl _o_scalbln _o_scalblnf _o_scalblnl _o_scalbn _o_scalbnf _o_scalbnl _o_set_terminate _o_setbuf _o_setlocale _o_setvbuf _o_sin _o_sinh _o_sqrt _o_srand _o_strcat_s _o_strcoll _o_strcpy_s _o_strerror _o_strerror_s _o_strftime _o_strncat_s _o_strncpy_s _o_strtod _o_strtof _o_strtok _o_strtok_s _o_strtol _o_strtold _o_strtoll _o_strtoul _o_strtoull _o_system _o_tan _o_tanh _o_terminate _o_tgamma _o_tgammaf _o_tgammal _o_tmpfile_s _o_tmpnam_s _o_tolower _o_toupper _o_towlower _o_towupper _o_ungetc _o_ungetwc _o_wcrtomb _o_wcrtomb_s _o_wcscat_s _o_wcscoll _o_wcscpy _o_wcscpy_s _o_wcsftime _o_wcsncat_s _o_wcsncpy_s _o_wcsrtombs _o_wcsrtombs_s _o_wcstod _o_wcstof _o_wcstok _o_wcstok_s _o_wcstol _o_wcstold _o_wcstoll _o_wcstombs _o_wcstombs_s _o_wcstoul _o_wcstoull _o_wctob _o_wctomb _o_wctomb_s _o_wmemcpy_s _o_wmemmove_s _open _open_osfhandle _pclose _pipe _popen _purecall _putc_nolock _putch _putch_nolock _putenv _putenv_s _putw _putwc_nolock _putwch _putwch_nolock _putws _query_app_type _query_new_handler _query_new_mode _read _realloc_base _recalloc _register_onexit_function _register_thread_local_exe_atexit_callback _resetstkoflw _rmdir _rmtmp _rotl _rotl64 _rotr _rotr64 _scalb _searchenv _searchenv_s _seh_filter_dll _seh_filter_exe _seh_longjmp_unwind _seh_longjmp_unwind4 _set_SSE2_enable _set_abort_behavior _set_app_type _set_controlfp _set_doserrno _set_errno _set_error_mode _set_fmode _set_invalid_parameter_handler _set_new_handler _set_new_mode _set_printf_count_output _set_purecall_handler _set_se_translator _set_thread_local_invalid_parameter_handler _seterrormode _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _sopen _sopen_dispatch _sopen_s _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _splitpath_s _stat32 _stat32i64 _stat64 _stat64i32 _statusfp _statusfp2 _strcoll_l _strdate _strdate_s _strdup _strerror _strerror_s _strftime_l _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strtime _strtime_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _swab _tell _telli64 _tempnam _time32 _time64 _timespec32_get _timespec64_get _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _tzset _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _umask _umask_s _ungetc_nolock _ungetch _ungetch_nolock _ungetwc_nolock _ungetwch _ungetwch_nolock _unlink _unloaddll _unlock_file _unlock_locales _utime32 _utime64 _waccess _waccess_s _wasctime _wasctime_s _wassert _wchdir _wchmod _wcreat _wcreate_locale _wcscoll_l _wcsdup _wcserror _wcserror_s _wcsftime_l _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctime32 _wctime32_s _wctime64 _wctime64_s _wctomb_l _wctomb_s_l _wctype _wdupenv_s _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst32 _wfindfirst32i64 _wfindfirst64 _wfindfirst64i32 _wfindnext32 _wfindnext32i64 _wfindnext64 _wfindnext64i32 _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _wgetenv_s _wmakepath _wmakepath_s _wmkdir _wmktemp _wmktemp_s _wopen _wperror _wpopen _wputenv _wputenv_s _wremove _wrename _write _wrmdir _wsearchenv _wsearchenv_s _wsetlocale _wsopen _wsopen_dispatch _wsopen_s _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wsplitpath_s _wstat32 _wstat32i64 _wstat64 _wstat64i32 _wstrdate _wstrdate_s _wstrtime _wstrtime_s _wsystem _wtempnam _wtmpnam _wtmpnam_s _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l _wunlink _wutime32 _wutime64 _y0 _y1 _yn abort abs acos acosh acoshf acoshl asctime asctime_s asin asinh asinhf asinhl atan atan2 atanh atanhf atanhl atof atoi atol atoll bsearch bsearch_s btowc c16rtomb c32rtomb cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl calloc carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil cexp cexpf cexpl cimag cimagf cimagl clearerr clearerr_s clock clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosh cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl div erf erfc erfcf erfcl erff erfl exit exp exp2 exp2f exp2l expm1 expm1f expm1l fabs fclose fdim fdimf fdiml feclearexcept fegetenv fegetexceptflag fegetround feholdexcept feof ferror fesetenv fesetexceptflag fesetround fetestexcept fflush fgetc fgetpos fgets fgetwc fgetws floor fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod fopen fopen_s fputc fputs fputwc fputws fread fread_s free freopen freopen_s frexp fseek fsetpos ftell fwrite getc getchar getenv getenv_s gets gets_s getwc getwchar hypot ilogb ilogbf ilogbl imaxabs imaxdiv is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv lgamma lgammaf lgammal llabs lldiv llrint llrintf llrintl llround llroundf llroundl localeconv log log10 log1p log1pf log1pl log2 log2f log2l logb logbf logbl longjmp lrint lrintf lrintl lround lroundf lroundl malloc mblen mbrlen mbrtoc16 mbrtoc32 mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc memchr memcmp memcpy memcpy_s memmove memmove_s memset modf nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml perror pow powf putc putchar puts putwc putwchar qsort qsort_s quick_exit raise rand rand_s realloc remainder remainderf remainderl remove remquo remquof remquol rename rewind rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl set_terminate set_unexpected setbuf setlocale setvbuf signal sin sinh sqrt srand strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strerror_s strftime strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strrchr strspn strstr strtod strtof strtoimax strtok strtok_s strtol strtold strtoll strtoul strtoull strtoumax strxfrm system tan tanh terminate tgamma tgammaf tgammal tmpfile tmpfile_s tmpnam tmpnam_s tolower toupper towctrans towlower towupper trunc truncf truncl unexpected ungetc ungetwc wcrtomb wcrtomb_s wcscat wcscat_s wcschr wcscmp wcscoll wcscpy wcscpy_s wcscspn wcsftime wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsrchr wcsrtombs wcsrtombs_s wcsspn wcsstr wcstod wcstof wcstoimax wcstok wcstok_s wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wcsxfrm wctob wctomb wctomb_s wctrans wctype wmemcpy_s wmemmove_s

uninst.exe.nsis

SHA256 4be76b01108f4bbbefb6aba5e913b14839a5660fe994c8dbefbb8cd5cb9487bf
MD5 9f932b485879bda2c3e891732a4e2e75
SHA1 0c71ca79f3e63181e35091a1bbb87485acde6f9f
SHA512 9fb3dfa84f6e66adcd7f1db5b4b255545b4ecbc8361c7d04fa2ef1b154c378c14e425cffd8cbe277bed553d82ce71c2663722105b2cdf47d2109b3d36b8306e3
SSDEEP 1536:B0FPrSmhb0VNqsm0SSK9J0TTxPEmRhzDchgIA:B2rh906s7cJ0Tu9hm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

urldrv/tdi/amd64/webshieldfilter.sys

IMPHASH b5514f7ee33e61e55bebf7ca20955200
SHA256 b5ff1ea46318772e179c56e8e386f9b6c5831a304ebc4783501304aa2a9f8d33
MD5 21a332af5c8e929415dbde71db19b8ca
SHA1 dd908daf05b0fa89de836110e68f97cc54859d21
SHA512 c0dad463aa71c1cfe2cf7de1b605be36f57fc49028a68b37e823ab5449f985b07d4c7b66e828aecbb2fffd240bab3f51d75a2d4ba43fb14674c0af50684d40be
SSDEEP 1536:9iwOws+rmFBi9rsWsZBey3EV+tj6scdDUfI:9VOwso9QHBeyEV+tj6scr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

a3:d1:d0:a0:2d:5b:f1:3b:73:56:b3:32:a7:24:94:d6:14:46:5f:0c:ba:f8:4f:3e:df:a9:f5:c2:00:d9:7b:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

47:58:2d:1d:c2:72:92:8b:e3:82:5a:4e:d7:83:a0:c8:e7:34:a4:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

69732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\repos\netfilter2\driver_tdi\std\objfre_wnet_amd64\amd64\webshieldfilter.pdb

Name

.text

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/tdi/i386/webshieldfilter.sys

IMPHASH f5c3ef1e88aabef8ecd0616cd29873f3
SHA256 3282e62445815de2e45092d9476f6ba5625dc50c96077845c2e32afbf8c9d2bd
MD5 2aa6d30e357b9a3e63d178f244482150
SHA1 44577e1a2fbc916fc8acca1ae5c7958ff64f8da4
SHA512 57964eb6f0e36a4eaf41e7586d1fb37e36896fa26687767012443898c1b59f8bd4900da1f639251ae726e60be8df97812a9b700d5064fcccc0343e59bbb2e0fe
SSDEEP 1536:8+wIzEJyjGTyUvtarIHl6v4Pm37sc6BUvCnUf:HwIzYyjA10IHl6gO37f6B
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

84:9b:2e:fc:e7:33:ff:46:4d:07:47:50:ba:f2:ad:cc:86:cc:70:ce:b6:62:04:9b:72:34:f2:f8:59:e2:31:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

88:49:c6:b2:d2:7b:17:8a:9b:af:73:38:43:61:42:23:86:c3:db:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

47038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\netfilter2\driver_tdi\std\objfre_wxp_x86\i386\webshieldfilter.pdb

Name

.text

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win10/amd64/webshieldfilter.sys

IMPHASH c089b867a4b799a2ece4dca0900e084b
SHA256 c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc
MD5 b797771c87184870eb95d2e50e17a9e7
SHA1 b303acad4220542c3150bb979aa966c2640434af
SHA512 60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341
SSDEEP 1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

12:be:60:b6:6a:cb:05:01:df:51:df:6d:97:b2:43:df:19:ab:f2:2c:56:28:20:c2:19:c2:54:90:ae:ea:d6:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

2

Major OS version

6

Entry point

67504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\x64\webshieldfilter.pdb

fwpkclnt.sys

FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmTransactionBegin0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsRedirectHandleCreate0 FwpsFreeNetBufferList0 FwpsFreeCloneNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsAcquireClassifyHandle0 FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsAllocateNetBufferAndNetBufferList0

ndis.sys

NdisFreeNetBufferListPool NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExAllocatePoolWithTag ExUuidCreate swprintf_s RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject __C_specific_handler SeExports RtlGetVersion RtlCompareMemory RtlValidSid

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win10/i386/webshieldfilter.sys

IMPHASH f0d95f2a52d65547aaaf71fdce71ca9f
SHA256 7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d
MD5 709ae7d4bb1817abf5b22bd5eb6d1943
SHA1 4123eb3773d91e5294abb1d1ad3cac52a34d5a48
SHA512 dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2
SSDEEP 1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d5:f1:8c:9e:97:59:77:23:d0:a2:65:3e:da:34:44:36:bc:2b:ae:37:27:35:b6:f0:71:3b:b5:eb:a9:04:9e:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

2

Major OS version

6

Entry point

62392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\Win32\webshieldfilter.pdb

fwpkclnt.sys

FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpmTransactionBegin0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFreeMemory0 FwpsRedirectHandleCreate0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsFlowAssociateContext0 FwpsAcquireClassifyHandle0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsFreeCloneNetBufferList0

ndis.sys

NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

ntoskrnl.exe

memset RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject SeExports RtlGetVersion KeQuerySystemTime _allmul _aulldiv _aullrem RtlCompareMemory RtlValidSid RtlUnwind memcpy ExUuidCreate ExAllocatePoolWithTag swprintf_s

hal

KeReleaseInStackQueuedSpinLock KeGetCurrentIrql KeAcquireInStackQueuedSpinLock

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win7/amd64/webshieldfilter.sys

IMPHASH 22602cf9c9696e7b40d9844e9d493520
SHA256 16399d8faf4a30ed463b8db7900fe0e67aa981a519d324f32349ba2abd779647
MD5 36a5f7f6601d2427426588ffd415ea89
SHA1 e69a5cfde38c82a6b0081e476fd83f1e3211337c
SHA512 3379adcfbcb23cbdfc62390a0ebedde75810b1f90c19bb66ce142594994a11545090583cc9d71e4e28fb2bf875fd5798f9adb9e339ba9a146513734fb74693dd
SSDEEP 1536:sGKnLHVUPDbU08dqnBtZ1ZPM1QubbE3CIXkuTtWuUf:mLHqDQZiaQA7IX5tW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

38:31:bf:f5:3a:ed:5f:8d:53:f1:74:d6:9b:a0:53:81:c4:68:d4:38:ee:9f:14:b2:ca:df:24:6e:6c:99:9e:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

77:8a:12:df:b3:22:57:23:07:ce:80:80:10:99:23:b0:8b:02:25:ca

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

77924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\repos\netfilter2\driver_wfp\std\objfre_win7_amd64\amd64\webshieldfilter.pdb

ntoskrnl.exe

KeBugCheckEx ExUuidCreate swprintf_s RtlCreateSecurityDescriptor RtlLengthSid IoAllocateMdl ObOpenObjectByPointer IoReleaseCancelSpinLock IoCreateDevice MmFreePagesFromMdl ObfDereferenceObject PsGetCurrentProcessId IoCreateSymbolicLink SeExports ZwSetSecurityObject KeWaitForSingleObject ObReferenceObjectByHandle ZwSetInformationThread IofCompleteRequest PsTerminateSystemThread ZwQueryValueKey MmMapLockedPagesSpecifyCache PsCreateSystemThread RtlAddAccessAllowedAce MmBuildMdlForNonPagedPool MmAllocatePagesForMdl KeInitializeEvent RtlAppendUnicodeToString MmGetSystemRoutineAddress KeSetEvent IoDeleteDevice RtlSetDaclSecurityDescriptor PsLookupProcessByProcessId RtlCreateAcl IoDeleteSymbolicLink MmUnmapLockedPages RtlCompareMemory RtlValidSid ExDeleteNPagedLookasideList ExQueryDepthSList IoFreeMdl ExpInterlockedPopEntrySList KeAcquireInStackQueuedSpinLock ExpInterlockedPushEntrySList KeReleaseInStackQueuedSpinLock ExInitializeNPagedLookasideList ExFreePoolWithTag ExAllocatePoolWithTag ZwOpenKey ZwClose RtlInitUnicodeString __C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpmSubLayerAdd0 FwpsQueryPacketInjectionState0 FwpmSubLayerDeleteByKey0 FwpmSubLayerEnum0 FwpmTransactionCommit0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerDestroyEnumHandle0 FwpmProviderContextDeleteByKey0 FwpmCalloutAdd0 FwpmProviderAdd0 FwpmTransactionAbort0 FwpmEngineOpen0 FwpsAcquireClassifyHandle0 FwpmFilterAdd0 FwpsPendClassify0 FwpsCalloutRegister1 FwpmTransactionBegin0 FwpmEngineClose0 FwpmFreeMemory0 FwpsAcquireWritableLayerDataPointer0 FwpsApplyModifiedLayerData0 FwpsInjectNetworkReceiveAsync0 FwpsFreeCloneNetBufferList0 FwpsInjectionHandleDestroy0 FwpsConstructIpHeaderForTransportPacket0 FwpsAllocateNetBufferAndNetBufferList0 FwpsInjectionHandleCreate0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkSendAsync0 FwpsCopyStreamDataToBuffer0 FwpsInjectTransportSendAsync0 FwpsFlowRemoveContext0 FwpsCloneStreamData0 FwpsCompleteClassify0 FwpsStreamInjectAsync0 FwpsReleaseClassifyHandle0 FwpsDiscardClonedStreamData0 FwpsFreeNetBufferList0 FwpmBfeStateUnsubscribeChanges0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0

ndis.sys

NdisAllocateGenericObject NdisWaitEvent NdisAllocateNetBufferListPool NdisInitializeEvent NdisFreeGenericObject NdisFreeNetBufferListPool NdisGetDataBuffer NdisRetreatNetBufferDataStart NdisAdvanceNetBufferDataStart

Name

.text

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

494B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win7/i386/webshieldfilter.sys

IMPHASH 57038502f0601ba9f99e8f3d4355bb56
SHA256 3512260c75fe5ab584e7c072c38a9b17f4603c7b735d9e9e1e0b2f0ff901abbd
MD5 9508031dacfbbaf2595fdc9dacdb3b2a
SHA1 7b85a2830535a53068a8167093de36a3d3176e26
SHA512 a27287409313bd084510f92677111b92424c6a39eaf20e53519f563fe5a8d3a339b5e5d7399713164b41e1e22fc6ad87f6161f602ebdc74f9785f87e0bafc01e
SSDEEP 1536:heDMC9wA1lHT6pmrnPWxtbHoncn3Ii62NOtwFqGuPUfM:AqOMpmrPWxFonXi628OAhP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

16:fe:47:46:39:5e:71:c2:f3:bf:e4:c5:ca:06:fa:a2:f5:12:2a:e5:9b:d2:87:9d:62:99:a4:3a:81:64:5d:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ed:ad:4d:c2:1f:66:63:34:6c:b5:1e:71:99:fc:ef:2d:bb:53:41:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

61502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\netfilter2\driver_wfp\std\objfre_win7_x86\i386\webshieldfilter.pdb

ntoskrnl.exe

memcpy RtlValidSid IoFreeMdl RtlUnwind KeBugCheckEx RtlCompareMemory KeTickCount _allmul _aulldiv KeQuerySystemTime ExUuidCreate swprintf_s KeInitializeEvent PsCreateSystemThread ZwSetInformationThread ObReferenceObjectByHandle RtlAppendUnicodeToString IoCreateDevice IoCreateSymbolicLink PsTerminateSystemThread MmGetSystemRoutineAddress PsLookupProcessByProcessId IoAllocateMdl MmBuildMdlForNonPagedPool IoReleaseCancelSpinLock PsGetCurrentProcessId IofCompleteRequest IoDeleteSymbolicLink IoDeleteDevice KeWaitForSingleObject ObfDereferenceObject MmAllocatePagesForMdl MmMapLockedPagesSpecifyCache MmFreePagesFromMdl MmUnmapLockedPages KeSetEvent ObOpenObjectByPointer RtlLengthSid SeExports RtlCreateAcl RtlAddAccessAllowedAce RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor ZwSetSecurityObject ZwQueryValueKey ExDeleteNPagedLookasideList ExInitializeNPagedLookasideList InterlockedPushEntrySList InterlockedPopEntrySList _aullrem ExFreePoolWithTag memset ExAllocatePoolWithTag RtlInitUnicodeString ZwOpenKey ZwClose

hal

KeReleaseInStackQueuedSpinLock KeGetCurrentIrql KeAcquireInStackQueuedSpinLock

fwpkclnt.sys

FwpsStreamInjectAsync0 FwpmEngineOpen0 FwpmProviderAdd0 FwpmSubLayerDeleteByKey0 FwpmProviderContextDeleteByKey0 FwpsAcquireClassifyHandle0 FwpsQueryPacketInjectionState0 FwpsFlowAssociateContext0 FwpmSubLayerAdd0 FwpmSubLayerCreateEnumHandle0 FwpmFreeMemory0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpsCalloutRegister1 FwpsCalloutUnregisterByKey0 FwpsPendClassify0 FwpsInjectionHandleCreate0 FwpsCopyStreamDataToBuffer0 FwpsInjectNetworkReceiveAsync0 FwpsAcquireWritableLayerDataPointer0 FwpsApplyModifiedLayerData0 FwpsAllocateNetBufferAndNetBufferList0 FwpsInjectTransportSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectNetworkSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsFreeCloneNetBufferList0 FwpsInjectionHandleDestroy0 FwpsFlowRemoveContext0 FwpsCloneStreamData0 FwpsCompleteClassify0 FwpsReleaseClassifyHandle0 FwpsDiscardClonedStreamData0 FwpsFreeNetBufferList0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0

ndis.sys

NdisFreeGenericObject NdisInitializeEvent NdisFreeNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisAllocateNetBufferListPool NdisAllocateGenericObject NdisWaitEvent

Name

.text

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win8/amd64/webshieldfilter.sys

IMPHASH c089b867a4b799a2ece4dca0900e084b
SHA256 c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc
MD5 b797771c87184870eb95d2e50e17a9e7
SHA1 b303acad4220542c3150bb979aa966c2640434af
SHA512 60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341
SSDEEP 1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

12:be:60:b6:6a:cb:05:01:df:51:df:6d:97:b2:43:df:19:ab:f2:2c:56:28:20:c2:19:c2:54:90:ae:ea:d6:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

2

Major OS version

6

Entry point

67504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\x64\webshieldfilter.pdb

fwpkclnt.sys

FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmTransactionBegin0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsRedirectHandleCreate0 FwpsFreeNetBufferList0 FwpsFreeCloneNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsAcquireClassifyHandle0 FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsAllocateNetBufferAndNetBufferList0

ndis.sys

NdisFreeNetBufferListPool NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExAllocatePoolWithTag ExUuidCreate swprintf_s RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject __C_specific_handler SeExports RtlGetVersion RtlCompareMemory RtlValidSid

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win8/i386/webshieldfilter.sys

IMPHASH f0d95f2a52d65547aaaf71fdce71ca9f
SHA256 7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d
MD5 709ae7d4bb1817abf5b22bd5eb6d1943
SHA1 4123eb3773d91e5294abb1d1ad3cac52a34d5a48
SHA512 dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2
SSDEEP 1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d5:f1:8c:9e:97:59:77:23:d0:a2:65:3e:da:34:44:36:bc:2b:ae:37:27:35:b6:f0:71:3b:b5:eb:a9:04:9e:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

2

Major OS version

6

Entry point

62392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\Win32\webshieldfilter.pdb

fwpkclnt.sys

FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpmTransactionBegin0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFreeMemory0 FwpsRedirectHandleCreate0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsFlowAssociateContext0 FwpsAcquireClassifyHandle0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsFreeCloneNetBufferList0

ndis.sys

NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

ntoskrnl.exe

memset RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject SeExports RtlGetVersion KeQuerySystemTime _allmul _aulldiv _aullrem RtlCompareMemory RtlValidSid RtlUnwind memcpy ExUuidCreate ExAllocatePoolWithTag swprintf_s

hal

KeReleaseInStackQueuedSpinLock KeGetCurrentIrql KeAcquireInStackQueuedSpinLock

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vcruntime140_cor3.dll

IMPHASH b06d4116da69a513992d529f84731e6f
SHA256 9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375
MD5 5f9d90d666620944943b0d6d1cca1945
SHA1 08ead2b72a4701349430d18d4a06d9343f777fa6
SHA512 be7a2c9dae85e425a280af552dbd7efd84373f780fa8472bab9a5ff29376c3a82d9dfa1fef32c6cf7f45ba6e389de90e090cb579eebff12dcfe12e6f3e7764d1
SSDEEP 1536:TpIhq3RcCBwca4EZEXNciFk+ikPC+ecbiLgavG:TpIY3RcCKcajodF4+ecbiLI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ad:01:91:01:b4:4d:b6:27:bd:81:a6:a5:6b:88:23:69:69:d1:e7:8a:38:80:a9:55:cc:db:68:2e:b0:31:9f:d9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

58576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\3\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

wpfgfx_cor3.dll

IMPHASH 5514d2d9b95c73162286e973c6f47da0
SHA256 068c4a6b02506533b60e649bf17ba8716e57a54dfb1526b31b2f2276b6bb7d3c
MD5 2bb0caf4797d7079181392490ecdea52
SHA1 4e22d8c7232a2248d8189b3a1dbb67ba79d1da18
SHA512 64826333b40cf162feea919d2d535b82c96abede50e94602e0f1cdfbda9b2af535306d71a6bdda136e67f72c931563b494564fc0620a9b52f5fa84807bb4d85e
SSDEEP 24576:IeaiNZRAxtScEssmDtxqMx5ySqR1w/xCgOnhq9kq+25LWmERb56e+7g/X:vaYDAxtScvxlZMn0kz25SmERb563c/X
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4f:26:2c:e1:12:18:71:59:53:0c:67:1b:f3:96:47:83:ae:59:16:aa:d2:90:d6:fa:45:ad:d3:47:eb:1b:22:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

6

Entry point

335488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\workspace\_work\1\s\artifacts\bin\WpfGfx\Win32\Release\wpfgfx_cor3.pdb

kernel32

GetCurrentThreadId ResetEvent TryEnterCriticalSection MulDiv QueryPerformanceCounter Sleep FindResourceW LoadResource LockResource GlobalUnlock QueryPerformanceFrequency InitializeSListHead InterlockedPushEntrySList QueryDepthSList InterlockedFlushSList SleepEx RtlCaptureStackBackTrace IsDebuggerPresent ExitProcess GetProcessHeap HeapAlloc HeapFree HeapReAlloc TerminateThread GetCurrentThread GetCurrentProcessId SetThreadPriority CreateEventW InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock LocalFree FormatMessageA GetSystemTimeAsFileTime WaitForSingleObjectEx RaiseException CloseHandle WaitForSingleObject SetEvent LoadLibraryExW FindClose FindFirstFileW GetSystemDirectoryW SystemTimeToFileTime LoadLibraryA LoadLibraryExA GetVersionExW DebugBreak GetModuleFileNameW CreateThread FreeLibrary OutputDebugStringW LoadLibraryW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount GetLastError DisableThreadLibraryCalls IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer UnhandledExceptionFilter GetModuleHandleW GetProcAddress GetSystemInfo VirtualProtect WaitForMultipleObjects GetTickCount SizeofResource UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualFree VirtualAlloc VerSetConditionMask VirtualQuery

advapi32

UnregisterTraceGuids RegQueryValueExW RegCloseKey AllocateLocallyUniqueId RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage TraceEvent RegOpenKeyExW

user32

ClientToScreen EnumDisplayMonitors GetMonitorInfoW SystemParametersInfoW EnumDisplayDevicesW MonitorFromWindow SetLayeredWindowAttributes WindowFromDC GetWindowRect EnumDisplaySettingsW GetClientRect InvalidateRect ReleaseDC GetDC OffsetRect GetWindowLongW GetGuiResources EqualRect IntersectRect SetRect IsRectEmpty PostMessageW RegisterWindowMessageW GetDesktopWindow MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW IsWindow UpdateLayeredWindow ScreenToClient GetParent GetWindowDC

gdi32

CreateCompatibleBitmap CreatePalette OffsetRgn RealizePalette GetSystemPaletteEntries GetDIBits GetRandomRgn CreateCompatibleDC SelectPalette CreateRectRgn GetRgnBox SetRectRgn GetRegionData RectInRegion CombineRgn CreateRectRgnIndirect SelectObject CreateDIBSection DeleteObject CreateICW GetDeviceCaps DeleteDC BitBlt SetLayout

ole32

CoUninitialize PropVariantClear PropVariantCopy CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

d3dcompiler_47_cor3

D3DCompile

api-ms-win-crt-runtime-l1-1-0

abort _initterm_e _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _invalid_parameter_noinfo_noreturn terminate

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-math-l1-1-0

floor _libm_sse2_tan_precise _libm_sse2_sqrt_precise _libm_sse2_sin_precise _libm_sse2_pow_precise _libm_sse2_log_precise _libm_sse2_exp_precise _libm_sse2_cos_precise _CIfmod _CIatan2 nextafterf modf _finite _isnan _copysign

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

calloc malloc free

api-ms-win-crt-string-l1-1-0

strcpy_s memset wcsncmp

ntdll

DbgPrintEx RtlInitializeBitMap RtlFindClearBitsAndSet DbgPrompt RtlClearBits NtQuerySystemInformation RtlUnwind RtlInterlockedFlushSList DbgBreakPoint RtlSetBits

api-ms-win-crt-utility-l1-1-0

qsort

GetNextPerfElementId IWICColorContext_GetExifColorSpace_Proxy IWICColorContext_GetProfileBytes_Proxy IWICColorContext_GetType_Proxy InteropDeviceBitmap_AddDirtyRect InteropDeviceBitmap_Create InteropDeviceBitmap_Detach InteropDeviceBitmap_GetAsSoftwareBitmap MIL3DCalcProjected2DBounds MILAddRef MILCreateEventProxy MILCreateFactory MILCreateStreamFromStreamDescriptor MILFactoryCreateBitmapRenderTarget MILFactoryCreateMediaPlayer MILFactoryCreateSWRenderTargetForBitmap MILIStreamWrite MILLoadResource MILMediaCanPause MILMediaClose MILMediaGetBufferingProgress MILMediaGetDownloadProgress MILMediaGetMediaLength MILMediaGetNaturalHeight MILMediaGetNaturalWidth MILMediaGetPosition MILMediaHasAudio MILMediaHasVideo MILMediaIsBuffering MILMediaNeedUIFrameUpdate MILMediaOpen MILMediaProcessExitHandler MILMediaSetBalance MILMediaSetIsScrubbingEnabled MILMediaSetPosition MILMediaSetRate MILMediaSetVolume MILMediaShutdown MILMediaStop MILQueryInterface MILRelease MILRenderTargetBitmapClear MILRenderTargetBitmapGetBitmap MILSwDoubleBufferedBitmapAddDirtyRect MILSwDoubleBufferedBitmapCreate MILSwDoubleBufferedBitmapGetBackBuffer MILSwDoubleBufferedBitmapProtectBackBuffer MILUpdateSystemParametersInfo MilChannel_AppendCommandData MilChannel_BeginCommand MilChannel_CloseBatch MilChannel_CommitChannel MilChannel_EndCommand MilChannel_GetMarshalType MilChannel_SetNotificationWindow MilChannel_SetReceiveBroadcastMessages MilCompositionEngine_DeinitializePartitionManager MilCompositionEngine_EnterCompositionEngineLock MilCompositionEngine_ExitCompositionEngineLock MilCompositionEngine_GetComposedEventId MilCompositionEngine_InitializePartitionManager MilCompositionEngine_UpdateSchedulerSettings MilComposition_PeekNextMessage MilComposition_SyncFlush MilComposition_WaitForNextMessage MilConnection_CreateChannel MilConnection_DestroyChannel MilContent_AttachToHwnd MilContent_DetachFromHwnd MilGlyphRun_GetGlyphOutline MilGlyphRun_ReleasePathGeometryData MilPlayer_Create MilPlayer_Process MilResource_CreateCWICWrapperBitmap MilResource_CreateOrAddRefOnChannel MilResource_DuplicateHandle MilResource_GetRefCountOnChannel MilResource_ReleaseOnChannel MilResource_SendCommand MilResource_SendCommandBitmapSource MilResource_SendCommandMedia MilUtility_ArcToBezier MilUtility_CopyPixelBuffer MilUtility_GeometryGetArea MilUtility_GetPointAtLengthFraction MilUtility_GetTileBrushMapping MilUtility_PathGeometryBounds MilUtility_PathGeometryCombine MilUtility_PathGeometryFlatten MilUtility_PathGeometryHitTest MilUtility_PathGeometryHitTestPathGeometry MilUtility_PathGeometryOutline MilUtility_PathGeometryWiden MilUtility_PolygonBounds MilUtility_PolygonHitTest MilVersionCheck MilVisualTarget_AttachToHwnd MilVisualTarget_DetachFromHwnd RenderOptions_ForceSoftwareRenderingModeForProcess RenderOptions_IsSoftwareRenderingForcedForProcess SetMilPerfInstrumentationFlags WgxConnection_Create WgxConnection_Disconnect WgxConnection_SameThreadPresent WgxConnection_ShouldForceSoftwareForGraphicsStreamClient

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wscf.exe

IMPHASH e756a2c7ee0dd3d54f8bcc5d0d1200ac
SHA256 b1e8f090eb376b2e137396e7009b0cb703b03640abd22e166f8de0d1ae9f754f
MD5 643d0c99635b9c5e1a33a6c27c49d632
SHA1 260199e59f87a85fac2643c8ab514e14b2194e62
SHA512 d0d0d36329fb712e4975a2cb1b4c3b212d56c26a95b85c245c762af5aae8ac9ec18621b43ca55f8f2051689efe066921322d592db72e83411efe5a6bebaea5ee
SSDEEP 6144:0Fb5y9XQG2/4xIdIevQiwhnFPEuEORXaRsRZKoAOWL8DY9Sh:0Z5GQG2/4xIxBhuEORXaRsRZKoAYYUh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

58:65:f9:af:fd:9c:26:35:e6:ba:c3:89:c6:8b:40:a0:a0:4a:e7:15:4e:e0:58:b3:5f:5e:57:85:e1:9e:46:81

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Denmead,ST=Hampshire,C=GB

Chains

Oct 6, 2021

CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Denmead,ST=Hampshire,C=GB

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

0

Major OS version

6

Entry point

45501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\protected_elam\protected_elam\Release\wscf.pdb

shell32

ShellExecuteW

kernel32

GetCPInfo WriteConsoleW MultiByteToWideChar LocalFree FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW GetFullPathNameW SetEndOfFile SetFilePointerEx AreFileApisANSI CloseHandle GetLastError SetLastError GetModuleHandleW GetProcAddress WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW ReadConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree GetFileSizeEx GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize

Sharing

General

Malware Config

Signatures

File Explorer

a759f450c9f1e6815b3dccd0ffd77e183794334eaf60ba77fb0cd7e5a7d7fdda

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aebb.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aecore.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aecrypto.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aedroid.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aedroid_gwf.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeemu.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp_gwf.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aegen.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aehelp.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_agen.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_gwf.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_mv.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelibinf.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelibinf_db.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelidb.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeml.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aemobile.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_gwf.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_mv.dat

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aepack.dll

PE Signature issue

kernel32

generic

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aerdl.dll