Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Overview
overview
7Static
static
34ae559f3f7...0f.exe
windows7-x64
74ae559f3f7...0f.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ce.dll
windows7-x64
3$PLUGINSDI...ce.dll
windows10-2004-x64
3entryprote...42.exe
windows7-x64
1entryprote...42.exe
windows10-2004-x64
1epclient32...42.dll
windows7-x64
3epclient32...42.dll
windows10-2004-x64
3epclient64...42.dll
windows7-x64
1epclient64...42.dll
windows10-2004-x64
1resources....42.dll
windows7-x64
1resources....42.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ae559f3f7568bce270ce1402b4543e0ca93ca0a82fa2379dd2dd01f988a370f.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4ae559f3f7568bce270ce1402b4543e0ca93ca0a82fa2379dd2dd01f988a370f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/service.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/service.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
entryprotect.exe.6.11.2.12042.exe
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
entryprotect.exe.6.11.2.12042.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
epclient32.dll.6.11.2.12042.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
epclient32.dll.6.11.2.12042.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
epclient64.dll.6.11.2.12042.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
epclient64.dll.6.11.2.12042.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources.dll.6.11.2.12042.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources.dll.6.11.2.12042.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
4ae559f3f7568bce270ce1402b4543e0ca93ca0a82fa2379dd2dd01f988a370f
-
Size
1.2MB
-
MD5
5bca3207c049e61b5fb46390a47641fe
-
SHA1
17ef609a3b6f76d976c5ef25c2006c04ba538762
-
SHA256
4ae559f3f7568bce270ce1402b4543e0ca93ca0a82fa2379dd2dd01f988a370f
-
SHA512
bea77809ac3131e34958a472be9b23d7babeca227f50e74d5e1d7fcb755cddde16f36e12fcdb3293126946750272f5098284584ace633892abc933b4e7928c15
-
SSDEEP
24576:JadawEpYQmaOV77yFMOLQb07f1a35V+3PesQ72T0mS+evixitgUt1h+XqNeaPmfU:89Ep1m77DOUb0oXOeP73jLDtLtGXkPms
Score
3/10
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource 4ae559f3f7568bce270ce1402b4543e0ca93ca0a82fa2379dd2dd01f988a370f unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/nsDialogs.dll unpack001/$PLUGINSDIR/service.dll
Files
-
4ae559f3f7568bce270ce1402b4543e0ca93ca0a82fa2379dd2dd01f988a370f.exe windows:4 windows x86 arch:x86
9dda1a1d1f8a1d13ae0297b47046b26e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
WriteFile
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CopyFileW
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 152KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
509a34b3a68a773e0afb4259e68f9f82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 867B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 662B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/modern-header.bmp
-
$PLUGINSDIR/modern-wizard.bmp
-
$PLUGINSDIR/nsDialogs.dll.dll windows:4 windows x86 arch:x86
3b477381217c97b22146297f93df2a92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyW
GetFileAttributesW
lstrcmpiW
MulDiv
lstrlenW
HeapFree
GetProcessHeap
GetCurrentDirectoryW
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
HeapAlloc
SetCurrentDirectoryW
user32
GetPropW
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
RemovePropW
CharPrevW
GetWindowLongW
DrawTextW
GetWindowTextW
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
MapDialogRect
GetClientRect
CharNextW
SendMessageW
DrawFocusRect
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 638B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/service.dll.dll windows:6 windows x86 arch:x86
bf80f774dc472dd1b7249bef414c0d12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\projects\ep6.10\submodules\build-environment\nsisplugins\service\Release_x86_14.2_static\build\service_nomanifest.pdb
Imports
kernel32
WriteConsoleW
CreateEventW
LocalFree
GetTickCount64
GetCurrentThreadId
GetCurrentProcessId
Sleep
WaitForSingleObject
SetLastError
GetLastError
OutputDebugStringA
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GlobalFree
lstrcpyW
lstrcpynW
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
RtlUnwind
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
DecodePointer
advapi32
CloseServiceHandle
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
SetServiceObjectSecurity
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ChangeServiceConfigW
ChangeServiceConfig2W
DeleteService
ControlService
CreateServiceW
EnumDependentServicesW
user32
wsprintfA
shlwapi
StrToIntW
StrToIntExW
wintrust
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminAddCatalog
Exports
Exports
DelayedStart
Exists
Install
InstallCatalog
InstallSecure
Remove
RemoveWithoutStopping
SetDescription
Start
Status
Stop
Sections
.text Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
entryprotect.exe.6.11.2.12042.new.exe windows:6 windows x64 arch:x64
eb58f05568bb9e9e99feaac7cdeca828
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:7f:d8:3b:7c:fd:a6:f2:7e:4c:0f:88:0e:44:d1:37Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before25/04/2024, 00:00Not After30/04/2027, 23:59SubjectSERIALNUMBER=06370537,CN=SentryBay Limited,O=SentryBay Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
50:d0:7b:cb:7e:17:6b:08:c6:f2:bc:f3:84:7b:9c:2b:63:94:6c:d3:fd:e6:de:f5:40:cb:7a:0f:15:b9:09:28Signer
Actual PE Digest50:d0:7b:cb:7e:17:6b:08:c6:f2:bc:f3:84:7b:9c:2b:63:94:6c:d3:fd:e6:de:f5:40:cb:7a:0f:15:b9:09:28Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\projects\ep6.10\service\service\Release_amd64_14.2_static\build\entryprotect_unsigned.pdb
Imports
kernel32
OutputDebugStringA
GetLastError
SetLastError
WaitForSingleObject
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
ReadFile
WriteFile
DebugBreak
CloseHandle
ConnectNamedPipe
DisconnectNamedPipe
HeapAlloc
HeapFree
GetProcessHeap
GetOverlappedResult
SetEvent
ResetEvent
CreateEventW
SignalObjectAndWait
WaitForMultipleObjects
GetCurrentProcess
CreateThread
OpenProcess
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LocalFree
FormatMessageA
FormatMessageW
QueryFullProcessImageNameW
CreateNamedPipeA
CallNamedPipeA
GetNamedPipeServerProcessId
WideCharToMultiByte
DeviceIoControl
CancelIoEx
GetModuleFileNameW
lstrcmpA
HeapSize
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
LocalAlloc
lstrlenW
GetTickCount
Sleep
lstrcpyW
GetVersion
TerminateProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
UnmapViewOfFile
DuplicateHandle
MapViewOfFile
GetExitCodeThread
ExitProcess
GetSystemDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
VirtualAllocEx
VirtualQueryEx
VirtualFreeEx
VirtualQuery
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThread
LoadLibraryW
VirtualProtect
TerminateThread
SetThreadContext
GetThreadContext
CreateRemoteThread
GetWindowsDirectoryW
CancelIo
GetFileSize
CreateFileMappingA
CreateFileMappingW
GetModuleHandleA
RaiseException
GetSystemInfo
LoadLibraryExA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FlushFileBuffers
RtlPcToFileHeader
RtlUnwindEx
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteConsoleW
GetCommandLineA
GetCommandLineW
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
user32
wsprintfA
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptDecrypt
BCryptDestroyKey
Sections
.text Size: 527KB - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
epclient32.dll.6.11.2.12042.new.dll windows:6 windows x86 arch:x86
80f2c52392069bef639b691d630bb583
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:7f:d8:3b:7c:fd:a6:f2:7e:4c:0f:88:0e:44:d1:37Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before25/04/2024, 00:00Not After30/04/2027, 23:59SubjectSERIALNUMBER=06370537,CN=SentryBay Limited,O=SentryBay Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
75:99:36:27:ac:4e:d3:2f:4e:54:43:ef:f7:7d:44:ba:9f:19:ba:67:c8:b7:7e:37:aa:10:fe:7d:4d:95:a0:33Signer
Actual PE Digest75:99:36:27:ac:4e:d3:2f:4e:54:43:ef:f7:7d:44:ba:9f:19:ba:67:c8:b7:7e:37:aa:10:fe:7d:4d:95:a0:33Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\projects\ep6.10\client\client\Release_x86_14.2_static\build\epclient_unsigned.pdb
Imports
kernel32
CreateFileW
ReadFile
SetFilePointer
DebugBreak
OutputDebugStringA
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
Wow64EnableWow64FsRedirection
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
FormatMessageW
QueryFullProcessImageNameW
K32GetModuleFileNameExW
CreateDirectoryW
WriteFile
SetEvent
ResetEvent
CreateEventW
SignalObjectAndWait
WaitForMultipleObjects
CreateThread
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetDateFormatA
GetTimeFormatA
GetThreadLocale
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW
LocalFree
lstrcmpA
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObjectEx
CreateEventA
OpenEventA
ProcessIdToSessionId
GetProcessId
OpenProcess
IsWow64Process
GetModuleHandleA
LoadLibraryA
lstrcmpW
IsBadReadPtr
WTSGetActiveConsoleSessionId
K32EnumProcesses
K32EnumProcessModules
K32EnumDeviceDrivers
K32GetDeviceDriverBaseNameW
EnterCriticalSection
LeaveCriticalSection
GetVolumeInformationW
GetWindowsDirectoryW
LocalAlloc
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
CreateNamedPipeA
CallNamedPipeA
InitializeCriticalSection
GlobalUnlock
GlobalLock
TerminateThread
MulDiv
DeviceIoControl
CancelIoEx
VirtualProtect
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapReAlloc
WriteConsoleW
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringEx
EncodePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
ExitThread
InterlockedIncrement
FlushInstructionCache
VirtualFree
Sleep
CreateFileMappingA
VirtualQuery
VirtualAlloc
GetVersion
ReleaseMutex
DuplicateHandle
SetThreadPriority
CreateSemaphoreW
ReleaseSemaphore
lstrcatA
CreateMutexW
CreatePipe
ReadProcessMemory
GetVersionExW
LoadLibraryW
GetThreadContext
VirtualAllocEx
VirtualQueryEx
TerminateProcess
ExitProcess
GetCurrentDirectoryW
OpenFileMappingW
OpenEventW
GetSystemInfo
LoadLibraryExA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageA
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFilePointerEx
AreFileApisANSI
user32
wsprintfA
GetSystemMetrics
DestroyIcon
MsgWaitForMultipleObjects
WindowFromDC
GetKeyboardState
SetWindowDisplayAffinity
GetWindowDisplayAffinity
GetAsyncKeyState
GetKeyboardLayoutNameA
EnumWindows
EnumChildWindows
IsIconic
ChangeWindowMessageFilterEx
GetWindowInfo
MonitorFromWindow
CopyIcon
DrawIconEx
LoadCursorW
FindWindowExW
GetParent
PtInRect
InflateRect
CopyRect
FillRect
ScreenToClient
GetCursorPos
GetWindowRect
GetClientRect
RedrawWindow
EndPaint
BeginPaint
SetTimer
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
SendMessageA
GetAncestor
IsGUIThread
PostQuitMessage
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetClassNameW
SetWindowLongW
SetWindowLongA
GetWindowLongW
GetWindowLongA
EmptyClipboard
GetClipboardData
CloseClipboard
OpenClipboard
GetClassInfoW
CallWindowProcW
CallWindowProcA
SendMessageW
GetKeyboardLayout
IsWindowUnicode
PostMessageW
PostMessageA
UnhookWinEvent
SetWinEventHook
GetForegroundWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
CallMsgFilterW
CallMsgFilterA
MapVirtualKeyExW
GetKeyState
GetMessageTime
GetWindowThreadProcessId
UnregisterClassW
LoadImageW
PeekMessageW
bcrypt
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDecrypt
BCryptDestroyKey
BCryptGetProperty
Sections
.text Size: 536KB - Virtual size: 535KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 87KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
epclient64.dll.6.11.2.12042.new.dll windows:6 windows x64 arch:x64
478d77d09dc31c25e5e6c9433fb3002b
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:7f:d8:3b:7c:fd:a6:f2:7e:4c:0f:88:0e:44:d1:37Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before25/04/2024, 00:00Not After30/04/2027, 23:59SubjectSERIALNUMBER=06370537,CN=SentryBay Limited,O=SentryBay Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
18:2e:59:29:98:e7:b1:1c:82:00:5b:04:34:d9:ed:ae:fe:91:1e:3a:c7:7f:62:2a:6a:94:f2:53:7f:f2:55:50Signer
Actual PE Digest18:2e:59:29:98:e7:b1:1c:82:00:5b:04:34:d9:ed:ae:fe:91:1e:3a:c7:7f:62:2a:6a:94:f2:53:7f:f2:55:50Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\projects\ep6.10\client\client\Release_amd64_14.2_static\build\epclient_unsigned.pdb
Imports
kernel32
CreateFileW
ReadFile
SetFilePointer
DebugBreak
OutputDebugStringA
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
FormatMessageW
QueryFullProcessImageNameW
K32GetModuleFileNameExW
CreateDirectoryW
WriteFile
SetEvent
ResetEvent
CreateEventW
SignalObjectAndWait
WaitForMultipleObjects
CreateThread
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetDateFormatA
GetTimeFormatA
GetThreadLocale
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW
LocalFree
lstrcmpA
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObjectEx
CreateEventA
OpenEventA
ProcessIdToSessionId
GetProcessId
OpenProcess
IsWow64Process
GetModuleHandleA
LoadLibraryA
lstrcmpW
IsBadReadPtr
WTSGetActiveConsoleSessionId
K32EnumProcesses
K32EnumProcessModules
K32EnumDeviceDrivers
K32GetDeviceDriverBaseNameW
EnterCriticalSection
LeaveCriticalSection
GetVolumeInformationW
GetWindowsDirectoryW
LocalAlloc
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
CreateNamedPipeA
CallNamedPipeA
InitializeCriticalSection
GlobalUnlock
GlobalLock
TerminateThread
MulDiv
DeviceIoControl
CancelIoEx
VirtualProtect
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapReAlloc
WriteConsoleW
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
LCMapStringEx
EncodePointer
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
QueryPerformanceCounter
GetStringTypeW
WideCharToMultiByte
ExitThread
FlushInstructionCache
VirtualFree
Sleep
CreateFileMappingA
VirtualQuery
VirtualAlloc
GetVersion
ReleaseMutex
DuplicateHandle
SetThreadPriority
CreateSemaphoreW
ReleaseSemaphore
lstrcatA
CreateMutexW
CreatePipe
ReadProcessMemory
LoadLibraryW
GetThreadContext
VirtualAllocEx
VirtualQueryEx
TerminateProcess
ExitProcess
GetCurrentDirectoryW
GetVersionExW
OpenFileMappingW
OpenEventW
GetSystemInfo
LoadLibraryExA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageA
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
user32
wsprintfA
GetSystemMetrics
DestroyIcon
MsgWaitForMultipleObjects
WindowFromDC
GetKeyboardState
SetWindowDisplayAffinity
GetWindowDisplayAffinity
GetAsyncKeyState
GetKeyboardLayoutNameA
EnumWindows
EnumChildWindows
IsIconic
ChangeWindowMessageFilterEx
GetWindowInfo
MonitorFromWindow
CopyIcon
DrawIconEx
LoadCursorW
FindWindowExW
GetParent
GetWindowLongW
PtInRect
InflateRect
CopyRect
FillRect
ScreenToClient
GetCursorPos
GetWindowRect
GetClientRect
RedrawWindow
EndPaint
BeginPaint
SetTimer
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
SendMessageA
GetAncestor
PeekMessageW
PostQuitMessage
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetClassNameW
SetWindowLongPtrW
SetWindowLongPtrA
GetWindowLongPtrW
GetWindowLongPtrA
EmptyClipboard
GetClipboardData
CloseClipboard
OpenClipboard
GetClassInfoW
CallWindowProcW
CallWindowProcA
SendMessageW
GetKeyboardLayout
IsWindowUnicode
PostMessageW
PostMessageA
UnhookWinEvent
SetWinEventHook
GetForegroundWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
CallMsgFilterW
CallMsgFilterA
MapVirtualKeyExW
GetKeyState
GetMessageTime
GetWindowThreadProcessId
UnregisterClassW
LoadImageW
IsGUIThread
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptEncrypt
BCryptDecrypt
BCryptDestroyKey
BCryptGenerateSymmetricKey
Sections
.text Size: 628KB - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 91KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
resources.dll.6.11.2.12042.new.dll windows:6 windows x64 arch:x64
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:7f:d8:3b:7c:fd:a6:f2:7e:4c:0f:88:0e:44:d1:37Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before25/04/2024, 00:00Not After30/04/2027, 23:59SubjectSERIALNUMBER=06370537,CN=SentryBay Limited,O=SentryBay Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
dc:7b:d3:33:ab:1a:d0:b6:2d:e8:0a:5d:0a:ce:7a:04:a4:26:66:ab:f4:53:59:93:6d:2e:48:f7:1c:d2:34:e8Signer
Actual PE Digestdc:7b:d3:33:ab:1a:d0:b6:2d:e8:0a:5d:0a:ce:7a:04:a4:26:66:ab:f4:53:59:93:6d:2e:48:f7:1c:d2:34:e8Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\projects\ep6.10\service\resources\Release_amd64_14.2_static\build\resources_unsigned.pdb
Sections
.rdata Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ