8870e6242e397575f54ac0acdfae13117dca54c01198c951537ddc228bb29c93

Sharing

Copy URL

Twitter E-mail

General

Target

8870e6242e397575f54ac0acdfae13117dca54c01198c951537ddc228bb29c93
Size

3.9MB
MD5

e1d69c9d80a3b36574e0a13860c26265
SHA1

9b09ee9803d552b8d56fc0ca00de09e55b903730
SHA256

8870e6242e397575f54ac0acdfae13117dca54c01198c951537ddc228bb29c93
SHA512

ee0fa3236474cf3c7e75dd319cca2bb1dee369546439fb28b48cda3353184978a4615abd285d0eccde4a149d264aadbbcdac672271a499d1ba2faceb832fe09d
SSDEEP

98304:0L8i6lt7tQLe+fvcNBq4aJN5+Ya+fRy3dgLEC9H:0Lqlt7CL1vc4JSY9ANgLZH

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/Doc/Manual.pdf	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
8870e6242e397575f54ac0acdfae13117dca54c01198c951537ddc228bb29c93
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/Bin/win10x64/EaseFlt.sys
unpack001/Bin/win10x86/EaseFlt.sys
unpack001/uninst.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsExec.dll

Files

8870e6242e397575f54ac0acdfae13117dca54c01198c951537ddc228bb29c93
.exe windows:4 windows x86 arch:x86

6e7f9a29f2c85394521a08b9f31f6275

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

4b45b7e00344a87332fbd12653854d1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryW
GlobalUnlock
GlobalLock
GetModuleHandleW
CloseHandle
SetEndOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
lstrcmpiW
lstrcatW
lstrcpynW
WritePrivateProfileStringW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc
WriteFile
SetFilePointer

user32

LoadCursorW
SetWindowRgn
GetDlgCtrlID
CloseClipboard
DrawFocusRect
OpenClipboard
DrawTextW
SetCursor
LoadIconW
LoadImageW
SetWindowLongW
CreateWindowExW
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamW
GetClientRect
ShowWindow
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
CallWindowProcW
PostMessageW
MessageBoxW
GetSysColor
CharNextW
wsprintfW
GetWindowTextW
SetWindowTextW
SendMessageW
GetWindowLongW
EnableMenuItem
PtInRect
MapWindowPoints
GetClipboardData

gdi32

SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectW

shell32

SHGetDesktopFolder
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
make_unicode
show

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
AutoEncryptDemo.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

51:be:83:fd:05:4f:a6:8c:dc:b7:1c:10:7e:6d:02:f2:47:0e:58:d4:3e:17:79:dd:14:07:3b:48:26:25:86:5d
Signer

Actual PE Digest

51:be:83:fd:05:4f:a6:8c:dc:b7:1c:10:7e:6d:02:f2:47:0e:58:d4:3e:17:79:dd:14:07:3b:48:26:25:86:5d

Digest Algorithm

sha256

PE Digest Matches

true

78:7c:af:e5:b6:2e:fc:1a:00:cf:9c:05:e9:84:26:a1:80:d9:97:c6
Signer

Actual PE Digest

78:7c:af:e5:b6:2e:fc:1a:00:cf:9c:05:e9:84:26:a1:80:d9:97:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\AutoEncryptDemo\obj\Release\AutoEncryptDemo.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AutoFileCryptTool.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e8:c2:47:cc:f1:fc:53:62:e1:ef:16:9f:c9:91:b8:22:83:33:a9:62:a6:84:50:91:a2:23:ef:61:e4:0f:0f:e9
Signer

Actual PE Digest

e8:c2:47:cc:f1:fc:53:62:e1:ef:16:9f:c9:91:b8:22:83:33:a9:62:a6:84:50:91:a2:23:ef:61:e4:0f:0f:e9

Digest Algorithm

sha256

PE Digest Matches

true

66:e0:9c:36:41:2e:27:43:56:65:bf:fb:5c:0b:8c:64:46:5c:bb:03
Signer

Actual PE Digest

66:e0:9c:36:41:2e:27:43:56:65:bf:fb:5c:0b:8c:64:46:5c:bb:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\AutoFileCryptTool\obj\Release\AutoFileCryptTool.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x64/EaseFlt.sys
.sys windows:10 windows x64 arch:x64

f0e8658bfab4efbda58ad39328bcaac2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Development\x64\Release\EaseFlt.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltDoCompletionProcessingWhenSafe
FltAllocatePoolAlignedWithTag
FltFreePoolAlignedWithTag
FltCreateFile
FltReadFile
FltWriteFile
FltSetInformationFile
FltClose
FltLockUserBuffer
FltInitializeOplock
FltAcquireResourceExclusive
FltReleaseResource
FltGetRequestorProcessId
FltIsDirectory
FltQueryInformationFile
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor
FltGetRoutineAddress
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltGetVolumeName
FltGetDestinationFileNameInformation
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltDeleteContext
FltDeleteInstanceContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltGetDiskDeviceObject
FltGetVolumeProperties
FltUninitializeOplock
FltFindExtraCreateParameter
FltGetEcpListFromCallbackData
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltCheckAndGrowNameControl
FltGetFileNameInformationUnsafe
FltCreateFileEx2

ksecdd.sys

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
SecLookupAccountSid

ntoskrnl.exe

RtlCompareUnicodeString
KeInitializeEvent
ExFreePoolWithTag
ExAcquireFastMutex
ExReleaseFastMutex
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoSetTopLevelIrp
ObReferenceObjectByHandle
ObfDereferenceObject
ExUuidCreate
PsGetCurrentThreadId
FsRtlInitializeFileLock
CcFlushCache
__C_specific_handler
MmForceSectionClosed
FsRtlTeardownPerStreamContexts
CcUninitializeCacheMap
RtlInitUnicodeString
RtlSetDaclSecurityDescriptor
MmIsAddressValid
MmSystemRangeStart
RtlCopyUnicodeString
RtlIsNtDdiVersionAvailable
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
ExDeleteResourceLite
ZwClose
IoVolumeDeviceToDosName
RtlValidSid
FsRtlUninitializeFileLock
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
KeSetEvent
KeWaitForSingleObject
RtlUpcaseUnicodeString
PsGetCurrentProcessId
FsRtlIsNameInExpression
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
IoGetTransactionParameterBlock
ZwQueryDirectoryFile
_local_unwind
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlGetElementGenericTable
RtlNumberGenericTableElements
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsGetProcessId
PsGetThreadId
PsGetThreadProcessId
PsProcessType
PsThreadType
CmRegisterCallback
CmUnRegisterCallback
ObQueryNameString
RtlIntegerToUnicodeString
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
RtlLengthSecurityDescriptor
DbgPrint
RtlTimeToTimeFields
ExSystemTimeToLocalTime
_vsnwprintf
RtlStringFromGUID
KeWaitForMultipleObjects
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
ZwWriteFile
KeBugCheckEx

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x64/EaseFltCPPDemo.exe
.exe windows:5 windows x64 arch:x64

d75ed198aa54007cbaf3ee976e0a5261

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fe:1f:6e:06:f9:f5:5e:77:f4:42:a4:f9:1f:f5:5b:64:9a:e8:fb:ca:38:e6:94:29:9c:bc:a5:40:04:c5:ea:70
Signer

Actual PE Digest

fe:1f:6e:06:f9:f5:5e:77:f4:42:a4:f9:1f:f5:5b:64:9a:e8:fb:ca:38:e6:94:29:9c:bc:a5:40:04:c5:ea:70

Digest Algorithm

sha256

PE Digest Matches

true

87:93:98:aa:88:70:c1:6e:d7:df:47:5a:11:87:0e:4c:f3:d5:5e:81
Signer

Actual PE Digest

87:93:98:aa:88:70:c1:6e:d7:df:47:5a:11:87:0e:4c:f3:d5:5e:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Development\Release\EaseFltCPPDemo.pdb

Imports

filterapi

GetUniqueComputerId
UnInstallDriver
InstallDriver
SetRegistrationKey
RegisterMessageCallback
Disconnect
IsDriverServiceRunning
SetConnectionTimeout
SetFilterType
AddProcessFilterRule
AddFileControlToProcessByName
AddRegistryFilterRule
AddNewFilterRule
RemoveBlockSaveAsProcessId
AddExcludeFileMaskToFilterRule
AESDecryptFileWithKey
RegisterIoRequest
SetBooleanConfig
AddIncludeProcessIdToFilterRule
AddIncludeUserNameToFilterRule
AddFileFilterRule
RegisterFileChangedEventsToFilterRule
RegisterMonitorIOToFilterRule
RegisterControlIOToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddBooleanConfigToFilterRule
SetVolumeControlFlag
AddExcludedProcessId
GetLastErrorMessage
AESDecryptFile
AESEncryptFile
SetFileSize
ResetConfigData
RemoveProcessIdRightsFromFilterRule
AddProcessIdRightsToFilterRule
GetAESHeader
AddReparseFileMaskToFilterRule

kernel32

Sleep
DeleteFileW
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetFileInformationByHandle
MoveFileW
SetFilePointer
SetEndOfFile
FindFirstFileW
FindClose
GetFileTime
GetFileAttributesW
FindNextFileW
GetStdHandle
SetConsoleTextAttribute
OutputDebugStringW
FormatMessageW
LocalFree
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
GetFileSizeEx
GetCurrentProcessId
ReadFile
CloseHandle
WriteFile
CreateFileW
GetLastError
CreateDirectoryW
WideCharToMultiByte
HeapAlloc
HeapFree
GetCommandLineW
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
HeapSize
HeapReAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetFileAttributesA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetExitCodeProcess
CreateProcessA
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW

advapi32

RegisterServiceCtrlHandlerW
GetFileSecurityW
SetFileSecurityW
GetUserNameW
StartServiceCtrlDispatcherW
SetServiceStatus
LookupAccountSidW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x64/FilterAPI.dll
.dll windows:5 windows x64 arch:x64

a868be19be7845c81e1a1ebf14031fb0

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ad:7c:8a:31:d6:7c:ea:a6:9a:ff:fd:21:d9:e3:f2:20:46:2e:fd:18:34:5e:45:83:70:d7:6d:e6:1f:88:d9:03
Signer

Actual PE Digest

ad:7c:8a:31:d6:7c:ea:a6:9a:ff:fd:21:d9:e3:f2:20:46:2e:fd:18:34:5e:45:83:70:d7:6d:e6:1f:88:d9:03

Digest Algorithm

sha256

PE Digest Matches

true

1e:cd:d8:d0:70:bd:bb:d8:eb:a6:59:fd:4b:4e:a7:01:bc:e6:e0:61
Signer

Actual PE Digest

1e:cd:d8:d0:70:bd:bb:d8:eb:a6:59:fd:4b:4e:a7:01:bc:e6:e0:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Development\Release\x64\FilterAPI.pdb

Imports

fltlib

FilterConnectCommunicationPort
FilterGetMessage
FilterReplyMessage
FilterLoad
FilterUnload
FilterSendMessage

kernel32

GetModuleFileNameW
SystemTimeToFileTime
GetComputerNameW
GetCurrentProcessId
GetSystemTime
SetEndOfFile
SetFileTime
DeviceIoControl
GetFileTime
MultiByteToWideChar
lstrcmpA
LocalAlloc
lstrcpyW
Process32FirstW
ResetEvent
SetLastError
GetOverlappedResult
OpenProcess
GetCurrentProcess
FormatMessageW
OutputDebugStringW
GetModuleHandleW
SetFileAttributesW
LocalFree
DeleteFileW
CloseHandle
BackupRead
CopyFileW
GetFileSizeEx
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetConsoleMode
GetConsoleCP
SetFilePointer
FlushFileBuffers
GetLocaleInfoW
LoadLibraryW
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
BackupSeek
SetFilePointerEx
Sleep
GetSystemDirectoryW
CreateThread
CreateToolhelp32Snapshot
Process32NextW
GetLastError
CreateEventW
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetProcAddress
ExitProcess
DecodePointer
GetStdHandle
EncodePointer
FlsGetValue
FlsFree
GetCurrentThread
FlsAlloc
HeapSize
HeapQueryInformation
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection

advapi32

OpenEventLogW
CloseEventLog
OpenProcessToken
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
CloseServiceHandle
DeleteService
EnumServicesStatusExW
RegSetValueExW
RegCloseKey
ControlService
QueryServiceStatus
RegDeleteKeyW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
ReportEventW

rpcrt4

UuidCreate

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptGetProperty

psapi

GetModuleFileNameExW

ntdll

NtSetInformationFile
NtQueryInformationFile
RtlNtStatusToDosError
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx

crypt32

CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

Exports

Exports

AESDecryptBytes
AESDecryptFile
AESDecryptFileToFile
AESDecryptFileWithKey
AESEncryptDecryptBuffer
AESEncryptFile
AESEncryptFileToFile
AESEncryptFileToFileWithTag
AESEncryptFileWithTag
ActivateLicense
AddAESHeader
AddBlockSaveAsProcessId
AddBooleanConfigToFilterRule
AddCreateFilterToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddExcludeFileMaskToFilterRule
AddExcludeProcessIdToFilterRule
AddExcludeProcessNameToFilterRule
AddExcludeUserNameToFilterRule
AddExcludedProcessId
AddFileCallbackIOToProcessByName
AddFileControlToProcessById
AddFileControlToProcessByName
AddFileFilterRule
AddFilterRule
AddHiddenFileMaskToFilterRule
AddIncludeProcessIdToFilterRule
AddIncludeProcessNameToFilterRule
AddIncludeUserNameToFilterRule
AddIncludedProcessId
AddNewFilterRule
AddProcessFilterRule
AddProcessIdRightsToFilterRule
AddProcessRightsToFilterRule
AddProtectedProcessId
AddRegistryFilterRule
AddRegistryFilterRuleByProcessId
AddRegistryFilterRuleByProcessName
AddReparseFileMaskToFilterRule
AddReparseTagData
AddTagData
AddUserRightsToFilterRule
CloseFileHandleInFilter
CreateFileAPI
CreateStubFile
CreateStubFileEx
Disconnect
EnableReparsePointTagEncryption
GetAESHeader
GetAESIV
GetAESTagData
GetFileHandleInFilter
GetLastErrorMessage
GetTagData
GetUniqueComputerId
InstallDriver
IsDriverServiceRunning
OpenStubFile
QueryAllocatedRanges
RegisterControlIOToFilterRule
RegisterEventTypeToFilterRule
RegisterFileChangedEventsToFilterRule
RegisterIoRequest
RegisterMessageCallback
RegisterMonitorIOToFilterRule
RemoveBlockSaveAsProcessId
RemoveBooleanConfigFromFilterRule
RemoveExcludeProcessId
RemoveFileControlFromProcessById
RemoveFileControlFromProcessByName
RemoveFilterRule
RemoveIncludeProcessId
RemoveProcessFilterRule
RemoveProcessIdRightsFromFilterRule
RemoveProcessRightsFromFilterRule
RemoveProtectedProcessId
RemoveRegistryFilterRuleByProcessId
RemoveRegistryFilterRuleByProcessName
RemoveTagData
ResetConfigData
SetAESHeaderSize
SetAESVersion
SetBooleanConfig
SetConnectionTimeout
SetFileSize
SetFilterType
SetHeaderFlags
SetIntegerData
SetMaxMonitorEventBuffersize
SetRegistrationKey
SetStringData
SetVolumeControlFlag
UnInstallDriver

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x64/FilterAPI.lib
Bin/win10x86/EaseFlt.sys
.sys windows:10 windows x64 arch:x64

f0e8658bfab4efbda58ad39328bcaac2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Development\x64\Release\EaseFlt.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltDoCompletionProcessingWhenSafe
FltAllocatePoolAlignedWithTag
FltFreePoolAlignedWithTag
FltCreateFile
FltReadFile
FltWriteFile
FltSetInformationFile
FltClose
FltLockUserBuffer
FltInitializeOplock
FltAcquireResourceExclusive
FltReleaseResource
FltGetRequestorProcessId
FltIsDirectory
FltQueryInformationFile
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor
FltGetRoutineAddress
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltGetVolumeName
FltGetDestinationFileNameInformation
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltDeleteContext
FltDeleteInstanceContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltGetDiskDeviceObject
FltGetVolumeProperties
FltUninitializeOplock
FltFindExtraCreateParameter
FltGetEcpListFromCallbackData
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltCheckAndGrowNameControl
FltGetFileNameInformationUnsafe
FltCreateFileEx2

ksecdd.sys

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
SecLookupAccountSid

ntoskrnl.exe

RtlCompareUnicodeString
KeInitializeEvent
ExFreePoolWithTag
ExAcquireFastMutex
ExReleaseFastMutex
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoSetTopLevelIrp
ObReferenceObjectByHandle
ObfDereferenceObject
ExUuidCreate
PsGetCurrentThreadId
FsRtlInitializeFileLock
CcFlushCache
__C_specific_handler
MmForceSectionClosed
FsRtlTeardownPerStreamContexts
CcUninitializeCacheMap
RtlInitUnicodeString
RtlSetDaclSecurityDescriptor
MmIsAddressValid
MmSystemRangeStart
RtlCopyUnicodeString
RtlIsNtDdiVersionAvailable
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
ExDeleteResourceLite
ZwClose
IoVolumeDeviceToDosName
RtlValidSid
FsRtlUninitializeFileLock
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
KeSetEvent
KeWaitForSingleObject
RtlUpcaseUnicodeString
PsGetCurrentProcessId
FsRtlIsNameInExpression
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
IoGetTransactionParameterBlock
ZwQueryDirectoryFile
_local_unwind
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlGetElementGenericTable
RtlNumberGenericTableElements
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsGetProcessId
PsGetThreadId
PsGetThreadProcessId
PsProcessType
PsThreadType
CmRegisterCallback
CmUnRegisterCallback
ObQueryNameString
RtlIntegerToUnicodeString
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
RtlLengthSecurityDescriptor
DbgPrint
RtlTimeToTimeFields
ExSystemTimeToLocalTime
_vsnwprintf
RtlStringFromGUID
KeWaitForMultipleObjects
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
ZwWriteFile
KeBugCheckEx

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x86/EaseFltCPPDemo.exe
.exe windows:5 windows x64 arch:x64

d75ed198aa54007cbaf3ee976e0a5261

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

92:f8:32:54:55:3a:35:aa:6c:98:ab:ec:90:8d:52:aa:d1:a5:ed:cc:1c:49:75:e6:c5:db:4c:60:db:c8:a3:c0
Signer

Actual PE Digest

92:f8:32:54:55:3a:35:aa:6c:98:ab:ec:90:8d:52:aa:d1:a5:ed:cc:1c:49:75:e6:c5:db:4c:60:db:c8:a3:c0

Digest Algorithm

sha256

PE Digest Matches

true

bd:6f:51:ef:05:21:0a:70:ae:db:b4:f4:0b:f0:d7:17:92:f2:7b:52
Signer

Actual PE Digest

bd:6f:51:ef:05:21:0a:70:ae:db:b4:f4:0b:f0:d7:17:92:f2:7b:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Development\Release\EaseFltCPPDemo.pdb

Imports

filterapi

GetUniqueComputerId
UnInstallDriver
InstallDriver
SetRegistrationKey
RegisterMessageCallback
Disconnect
IsDriverServiceRunning
SetConnectionTimeout
SetFilterType
AddProcessFilterRule
AddFileControlToProcessByName
AddRegistryFilterRule
AddNewFilterRule
RemoveBlockSaveAsProcessId
AddExcludeFileMaskToFilterRule
AESDecryptFileWithKey
RegisterIoRequest
SetBooleanConfig
AddIncludeProcessIdToFilterRule
AddIncludeUserNameToFilterRule
AddFileFilterRule
RegisterFileChangedEventsToFilterRule
RegisterMonitorIOToFilterRule
RegisterControlIOToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddBooleanConfigToFilterRule
SetVolumeControlFlag
AddExcludedProcessId
GetLastErrorMessage
AESDecryptFile
AESEncryptFile
SetFileSize
ResetConfigData
RemoveProcessIdRightsFromFilterRule
AddProcessIdRightsToFilterRule
GetAESHeader
AddReparseFileMaskToFilterRule

kernel32

Sleep
DeleteFileW
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetFileInformationByHandle
MoveFileW
SetFilePointer
SetEndOfFile
FindFirstFileW
FindClose
GetFileTime
GetFileAttributesW
FindNextFileW
GetStdHandle
SetConsoleTextAttribute
OutputDebugStringW
FormatMessageW
LocalFree
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
GetFileSizeEx
GetCurrentProcessId
ReadFile
CloseHandle
WriteFile
CreateFileW
GetLastError
CreateDirectoryW
WideCharToMultiByte
HeapAlloc
HeapFree
GetCommandLineW
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
HeapSize
HeapReAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetFileAttributesA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetExitCodeProcess
CreateProcessA
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW

advapi32

RegisterServiceCtrlHandlerW
GetFileSecurityW
SetFileSecurityW
GetUserNameW
StartServiceCtrlDispatcherW
SetServiceStatus
LookupAccountSidW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x86/FilterAPI.dll
.dll windows:5 windows x86 arch:x86

4cd2f683f90837dbe18b46cd55118483

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9e:1a:a3:d0:05:b1:64:db:08:bc:3f:61:10:55:02:8f:86:72:3a:74:12:8d:c2:c3:97:d5:4a:76:cf:ad:24:e2
Signer

Actual PE Digest

9e:1a:a3:d0:05:b1:64:db:08:bc:3f:61:10:55:02:8f:86:72:3a:74:12:8d:c2:c3:97:d5:4a:76:cf:ad:24:e2

Digest Algorithm

sha256

PE Digest Matches

true

4d:73:f7:62:42:d5:f3:75:78:dc:f5:75:b5:49:81:25:1b:db:45:62
Signer

Actual PE Digest

4d:73:f7:62:42:d5:f3:75:78:dc:f5:75:b5:49:81:25:1b:db:45:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Development\Release\Win32\FilterAPI.pdb

Imports

fltlib

FilterLoad
FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterUnload
FilterConnectCommunicationPort

kernel32

GetModuleFileNameW
SystemTimeToFileTime
GetComputerNameW
GetCurrentProcessId
GetSystemTime
SetEndOfFile
SetFileTime
DeviceIoControl
GetFileTime
MultiByteToWideChar
lstrcmpA
LocalAlloc
CopyFileW
Sleep
GetSystemDirectoryW
CreateThread
CreateToolhelp32Snapshot
Process32NextW
CreateEventW
Process32FirstW
ResetEvent
SetLastError
GetOverlappedResult
OpenProcess
GetCurrentProcess
FormatMessageW
OutputDebugStringW
GetModuleHandleW
SetFileAttributesW
LocalFree
DeleteFileW
CloseHandle
BackupRead
WriteConsoleW
SetStdHandle
GetStringTypeW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointer
LoadLibraryW
GetLastError
GetFileSizeEx
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
BackupSeek
SetFilePointerEx
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetProcAddress
ExitProcess
GetStdHandle
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount

advapi32

RegSetValueExW
ReportEventW
CloseEventLog
OpenProcessToken
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
RegDeleteKeyW
QueryServiceStatus
EnumServicesStatusExW
OpenEventLogW
RegCloseKey

rpcrt4

UuidCreate

bcrypt

BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey

psapi

GetModuleFileNameExW

ntdll

NtQueryInformationFile
RtlNtStatusToDosError
RtlUnwind
NtSetInformationFile

crypt32

CryptMsgClose
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam

Exports

Exports

AESDecryptBytes
AESDecryptFile
AESDecryptFileToFile
AESDecryptFileWithKey
AESEncryptDecryptBuffer
AESEncryptFile
AESEncryptFileToFile
AESEncryptFileToFileWithTag
AESEncryptFileWithTag
ActivateLicense
AddAESHeader
AddBlockSaveAsProcessId
AddBooleanConfigToFilterRule
AddCreateFilterToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddExcludeFileMaskToFilterRule
AddExcludeProcessIdToFilterRule
AddExcludeProcessNameToFilterRule
AddExcludeUserNameToFilterRule
AddExcludedProcessId
AddFileCallbackIOToProcessByName
AddFileControlToProcessById
AddFileControlToProcessByName
AddFileFilterRule
AddFilterRule
AddHiddenFileMaskToFilterRule
AddIncludeProcessIdToFilterRule
AddIncludeProcessNameToFilterRule
AddIncludeUserNameToFilterRule
AddIncludedProcessId
AddNewFilterRule
AddProcessFilterRule
AddProcessIdRightsToFilterRule
AddProcessRightsToFilterRule
AddProtectedProcessId
AddRegistryFilterRule
AddRegistryFilterRuleByProcessId
AddRegistryFilterRuleByProcessName
AddReparseFileMaskToFilterRule
AddReparseTagData
AddTagData
AddUserRightsToFilterRule
CloseFileHandleInFilter
CreateFileAPI
CreateStubFile
CreateStubFileEx
Disconnect
EnableReparsePointTagEncryption
GetAESHeader
GetAESIV
GetAESTagData
GetFileHandleInFilter
GetLastErrorMessage
GetTagData
GetUniqueComputerId
InstallDriver
IsDriverServiceRunning
OpenStubFile
QueryAllocatedRanges
RegisterControlIOToFilterRule
RegisterEventTypeToFilterRule
RegisterFileChangedEventsToFilterRule
RegisterIoRequest
RegisterMessageCallback
RegisterMonitorIOToFilterRule
RemoveBlockSaveAsProcessId
RemoveBooleanConfigFromFilterRule
RemoveExcludeProcessId
RemoveFileControlFromProcessById
RemoveFileControlFromProcessByName
RemoveFilterRule
RemoveIncludeProcessId
RemoveProcessFilterRule
RemoveProcessIdRightsFromFilterRule
RemoveProcessRightsFromFilterRule
RemoveProtectedProcessId
RemoveRegistryFilterRuleByProcessId
RemoveRegistryFilterRuleByProcessName
RemoveTagData
ResetConfigData
SetAESHeaderSize
SetAESVersion
SetBooleanConfig
SetConnectionTimeout
SetFileSize
SetFilterType
SetHeaderFlags
SetIntegerData
SetMaxMonitorEventBuffersize
SetRegistrationKey
SetStringData
SetVolumeControlFlag
UnInstallDriver

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win10x86/FilterAPI.lib
Bin/win32/EaseFlt.sys
.sys windows:6 windows x86 arch:x86

238130533875d6f37a1c37123c9ce112

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:45

Not After

15-04-2021 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:8d:cb:7b:93:3c:c3:6b:91:7c:46:83:4d:36:cd:11:0f:d9:91:37:aa:3e:08:ee:c4:2f:5f:57:c6:11:cb:52
Signer

Actual PE Digest

24:8d:cb:7b:93:3c:c3:6b:91:7c:46:83:4d:36:cd:11:0f:d9:91:37:aa:3e:08:ee:c4:2f:5f:57:c6:11:cb:52

Digest Algorithm

sha256

PE Digest Matches

true

3b:99:d6:dd:83:88:a1:ea:84:84:28:b6:79:91:c0:76:aa:da:23:f6
Signer

Actual PE Digest

3b:99:d6:dd:83:88:a1:ea:84:84:28:b6:79:91:c0:76:aa:da:23:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\development\filterdriver\easefilter\source\objfre_wxp_x86\i386\EaseFlt.pdb

Imports

ntoskrnl.exe

IoSetTopLevelIrp
ExAcquireResourceSharedLite
RtlDeleteElementGenericTable
RtlGetElementGenericTable
RtlNumberGenericTableElements
RtlLookupElementGenericTable
RtlInsertElementGenericTable
PsGetProcessId
PsGetThreadId
PsGetThreadProcessId
PsThreadType
PsSetCreateThreadNotifyRoutine
PsProcessType
RtlInitializeGenericTable
ExUuidCreate
ZwQueryDirectoryFile
ZwDeleteKey
ZwCreateKey
ZwSetValueKey
RtlIntegerToUnicodeString
ZwDeleteValueKey
RtlStringFromGUID
ZwWriteFile
PsTerminateSystemThread
KeWaitForMultipleObjects
PsCreateSystemThread
ObQueryNameString
CmRegisterCallback
CmUnRegisterCallback
ZwReadFile
ZwQueryInformationFile
KeTickCount
KeBugCheckEx
MmUnlockPages
PsGetCurrentProcessId
RtlUpcaseUnicodeString
FsRtlIsNameInExpression
KeSetEvent
MmBuildMdlForNonPagedPool
RtlLengthSecurityDescriptor
FsRtlTeardownPerStreamContexts
FsRtlInitializeFileLock
RtlCopyUnicodeString
DbgPrint
memmove
KeWaitForSingleObject
ZwOpenKey
ZwQueryValueKey
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
IoFreeMdl
ExSystemTimeToLocalTime
RtlTimeToTimeFields
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
_vsnwprintf
RtlSetDaclSecurityDescriptor
ExInitializeNPagedLookasideList
_alldiv
_allmul
KeQuerySystemTime
ExDeleteNPagedLookasideList
InterlockedPushEntrySList
InterlockedPopEntrySList
ExAcquireResourceExclusiveLite
CcFlushCache
CcUninitializeCacheMap
ExReleaseResourceLite
FsRtlUninitializeFileLock
PsGetCurrentThreadId
ZwOpenThreadTokenEx
ZwOpenProcessTokenEx
ZwQueryInformationToken
RtlValidSid
ZwClose
ExDeleteResourceLite
IoVolumeDeviceToDosName
ExInitializeResourceLite
ObfDereferenceObject
RtlCompareUnicodeString
MmSystemRangeStart
MmIsAddressValid
KeInitializeEvent
IoWMIRegistrationControl
RtlCompareMemory
MmForceSectionClosed
ObReferenceObjectByHandle
RtlInitUnicodeString
MmGetSystemRoutineAddress
memset
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
PsRemoveCreateThreadNotifyRoutine
ExFreePoolWithTag
PsGetVersion
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex

fltmgr.sys

FltParseFileNameInformation
FltStartFiltering
FltRegisterFilter
FltReleaseContext
FltReferenceContext
FltGetInstanceContext
FltSetCallbackDataDirty
FltCheckAndGrowNameControl
FltGetFileNameInformationUnsafe
FltWriteFile
FltSetInformationFile
FltInitializeOplock
FltReadFile
FltAllocatePoolAlignedWithTag
FltDoCompletionProcessingWhenSafe
FltLockUserBuffer
FltAllocateCallbackData
FltPerformSynchronousIo
FltFreeCallbackData
FltIsDirectory
FltGetRoutineAddress
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltFreeSecurityDescriptor
FltCreateFile
FltSendMessage
FltCloseClientPort
FltCloseCommunicationPort
FltGetFileNameInformation
FltGetDestinationFileNameInformation
FltGetStreamContext
FltReleaseFileNameInformation
FltSetStreamHandleContext
FltFreePoolAlignedWithTag
FltUninitializeOplock
FltClose
FltGetRequestorProcessId
FltSetStreamContext
FltQueryInformationFile
FltAcquireResourceExclusive
FltReleaseResource
FltDeleteInstanceContext
FltGetDiskDeviceObject
FltGetVolumeName
FltAllocateContext
FltGetVolumeProperties
FltSetInstanceContext
FltDeleteContext
FltGetStreamHandleContext
FltUnregisterFilter

ksecdd.sys

SecLookupAccountSid

cng.sys

BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptEncrypt
BCryptSetProperty
BCryptGenerateSymmetricKey

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win32/EaseFltCPPDemo.exe
.exe windows:5 windows x64 arch:x64

d75ed198aa54007cbaf3ee976e0a5261

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

92:f8:32:54:55:3a:35:aa:6c:98:ab:ec:90:8d:52:aa:d1:a5:ed:cc:1c:49:75:e6:c5:db:4c:60:db:c8:a3:c0
Signer

Actual PE Digest

92:f8:32:54:55:3a:35:aa:6c:98:ab:ec:90:8d:52:aa:d1:a5:ed:cc:1c:49:75:e6:c5:db:4c:60:db:c8:a3:c0

Digest Algorithm

sha256

PE Digest Matches

true

bd:6f:51:ef:05:21:0a:70:ae:db:b4:f4:0b:f0:d7:17:92:f2:7b:52
Signer

Actual PE Digest

bd:6f:51:ef:05:21:0a:70:ae:db:b4:f4:0b:f0:d7:17:92:f2:7b:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Development\Release\EaseFltCPPDemo.pdb

Imports

filterapi

GetUniqueComputerId
UnInstallDriver
InstallDriver
SetRegistrationKey
RegisterMessageCallback
Disconnect
IsDriverServiceRunning
SetConnectionTimeout
SetFilterType
AddProcessFilterRule
AddFileControlToProcessByName
AddRegistryFilterRule
AddNewFilterRule
RemoveBlockSaveAsProcessId
AddExcludeFileMaskToFilterRule
AESDecryptFileWithKey
RegisterIoRequest
SetBooleanConfig
AddIncludeProcessIdToFilterRule
AddIncludeUserNameToFilterRule
AddFileFilterRule
RegisterFileChangedEventsToFilterRule
RegisterMonitorIOToFilterRule
RegisterControlIOToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddBooleanConfigToFilterRule
SetVolumeControlFlag
AddExcludedProcessId
GetLastErrorMessage
AESDecryptFile
AESEncryptFile
SetFileSize
ResetConfigData
RemoveProcessIdRightsFromFilterRule
AddProcessIdRightsToFilterRule
GetAESHeader
AddReparseFileMaskToFilterRule

kernel32

Sleep
DeleteFileW
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetFileInformationByHandle
MoveFileW
SetFilePointer
SetEndOfFile
FindFirstFileW
FindClose
GetFileTime
GetFileAttributesW
FindNextFileW
GetStdHandle
SetConsoleTextAttribute
OutputDebugStringW
FormatMessageW
LocalFree
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
GetFileSizeEx
GetCurrentProcessId
ReadFile
CloseHandle
WriteFile
CreateFileW
GetLastError
CreateDirectoryW
WideCharToMultiByte
HeapAlloc
HeapFree
GetCommandLineW
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
HeapSize
HeapReAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetFileAttributesA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetExitCodeProcess
CreateProcessA
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW

advapi32

RegisterServiceCtrlHandlerW
GetFileSecurityW
SetFileSecurityW
GetUserNameW
StartServiceCtrlDispatcherW
SetServiceStatus
LookupAccountSidW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win32/FilterAPI.dll
.dll windows:5 windows x86 arch:x86

4cd2f683f90837dbe18b46cd55118483

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9e:1a:a3:d0:05:b1:64:db:08:bc:3f:61:10:55:02:8f:86:72:3a:74:12:8d:c2:c3:97:d5:4a:76:cf:ad:24:e2
Signer

Actual PE Digest

9e:1a:a3:d0:05:b1:64:db:08:bc:3f:61:10:55:02:8f:86:72:3a:74:12:8d:c2:c3:97:d5:4a:76:cf:ad:24:e2

Digest Algorithm

sha256

PE Digest Matches

true

4d:73:f7:62:42:d5:f3:75:78:dc:f5:75:b5:49:81:25:1b:db:45:62
Signer

Actual PE Digest

4d:73:f7:62:42:d5:f3:75:78:dc:f5:75:b5:49:81:25:1b:db:45:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Development\Release\Win32\FilterAPI.pdb

Imports

fltlib

FilterLoad
FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterUnload
FilterConnectCommunicationPort

kernel32

GetModuleFileNameW
SystemTimeToFileTime
GetComputerNameW
GetCurrentProcessId
GetSystemTime
SetEndOfFile
SetFileTime
DeviceIoControl
GetFileTime
MultiByteToWideChar
lstrcmpA
LocalAlloc
CopyFileW
Sleep
GetSystemDirectoryW
CreateThread
CreateToolhelp32Snapshot
Process32NextW
CreateEventW
Process32FirstW
ResetEvent
SetLastError
GetOverlappedResult
OpenProcess
GetCurrentProcess
FormatMessageW
OutputDebugStringW
GetModuleHandleW
SetFileAttributesW
LocalFree
DeleteFileW
CloseHandle
BackupRead
WriteConsoleW
SetStdHandle
GetStringTypeW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointer
LoadLibraryW
GetLastError
GetFileSizeEx
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
BackupSeek
SetFilePointerEx
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetProcAddress
ExitProcess
GetStdHandle
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount

advapi32

RegSetValueExW
ReportEventW
CloseEventLog
OpenProcessToken
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
RegDeleteKeyW
QueryServiceStatus
EnumServicesStatusExW
OpenEventLogW
RegCloseKey

rpcrt4

UuidCreate

bcrypt

BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey

psapi

GetModuleFileNameExW

ntdll

NtQueryInformationFile
RtlNtStatusToDosError
RtlUnwind
NtSetInformationFile

crypt32

CryptMsgClose
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam

Exports

Exports

AESDecryptBytes
AESDecryptFile
AESDecryptFileToFile
AESDecryptFileWithKey
AESEncryptDecryptBuffer
AESEncryptFile
AESEncryptFileToFile
AESEncryptFileToFileWithTag
AESEncryptFileWithTag
ActivateLicense
AddAESHeader
AddBlockSaveAsProcessId
AddBooleanConfigToFilterRule
AddCreateFilterToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddExcludeFileMaskToFilterRule
AddExcludeProcessIdToFilterRule
AddExcludeProcessNameToFilterRule
AddExcludeUserNameToFilterRule
AddExcludedProcessId
AddFileCallbackIOToProcessByName
AddFileControlToProcessById
AddFileControlToProcessByName
AddFileFilterRule
AddFilterRule
AddHiddenFileMaskToFilterRule
AddIncludeProcessIdToFilterRule
AddIncludeProcessNameToFilterRule
AddIncludeUserNameToFilterRule
AddIncludedProcessId
AddNewFilterRule
AddProcessFilterRule
AddProcessIdRightsToFilterRule
AddProcessRightsToFilterRule
AddProtectedProcessId
AddRegistryFilterRule
AddRegistryFilterRuleByProcessId
AddRegistryFilterRuleByProcessName
AddReparseFileMaskToFilterRule
AddReparseTagData
AddTagData
AddUserRightsToFilterRule
CloseFileHandleInFilter
CreateFileAPI
CreateStubFile
CreateStubFileEx
Disconnect
EnableReparsePointTagEncryption
GetAESHeader
GetAESIV
GetAESTagData
GetFileHandleInFilter
GetLastErrorMessage
GetTagData
GetUniqueComputerId
InstallDriver
IsDriverServiceRunning
OpenStubFile
QueryAllocatedRanges
RegisterControlIOToFilterRule
RegisterEventTypeToFilterRule
RegisterFileChangedEventsToFilterRule
RegisterIoRequest
RegisterMessageCallback
RegisterMonitorIOToFilterRule
RemoveBlockSaveAsProcessId
RemoveBooleanConfigFromFilterRule
RemoveExcludeProcessId
RemoveFileControlFromProcessById
RemoveFileControlFromProcessByName
RemoveFilterRule
RemoveIncludeProcessId
RemoveProcessFilterRule
RemoveProcessIdRightsFromFilterRule
RemoveProcessRightsFromFilterRule
RemoveProtectedProcessId
RemoveRegistryFilterRuleByProcessId
RemoveRegistryFilterRuleByProcessName
RemoveTagData
ResetConfigData
SetAESHeaderSize
SetAESVersion
SetBooleanConfig
SetConnectionTimeout
SetFileSize
SetFilterType
SetHeaderFlags
SetIntegerData
SetMaxMonitorEventBuffersize
SetRegistrationKey
SetStringData
SetVolumeControlFlag
UnInstallDriver

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/win32/FilterAPI.lib
Bin/x64/EaseFlt.sys
.sys windows:6 windows x64 arch:x64

48f2ba08eb03bc96cb417e3ece40313d

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:45

Not After

15-04-2021 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:2e:97:3a:2a:03:8d:40:32:e5:36:50:f0:de:3c:26:ea:97:84:81:6c:f0:83:51:48:41:a8:49:df:f9:83:e5
Signer

Actual PE Digest

52:2e:97:3a:2a:03:8d:40:32:e5:36:50:f0:de:3c:26:ea:97:84:81:6c:f0:83:51:48:41:a8:49:df:f9:83:e5

Digest Algorithm

sha256

PE Digest Matches

true

6b:2d:b1:a2:38:07:7e:83:0b:cc:4a:68:a4:4b:ab:01:8f:68:a9:84
Signer

Actual PE Digest

6b:2d:b1:a2:38:07:7e:83:0b:cc:4a:68:a4:4b:ab:01:8f:68:a9:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\development\filterdriver\easefilter\source\objfre_wnet_amd64\amd64\EaseFlt.pdb

Imports

ntoskrnl.exe

ExUuidCreate
ExAcquireResourceSharedLite
FsRtlInitializeFileLock
IoSetTopLevelIrp
ObReferenceObjectByHandle
MmUnlockPages
PsProcessType
RtlNumberGenericTableElements
RtlGetElementGenericTable
PsRemoveCreateThreadNotifyRoutine
PsSetCreateThreadNotifyRoutine
PsGetThreadId
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
PsThreadType
PsGetThreadProcessId
PsGetProcessId
FsRtlIsNameInExpression
RtlInsertElementGenericTable
ZwQueryDirectoryFile
ZwCreateKey
RtlIntegerToUnicodeString
ZwDeleteValueKey
ZwSetValueKey
ZwDeleteKey
RtlStringFromGUID
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
KeWaitForMultipleObjects
ZwWriteFile
KeAcquireSpinLockRaiseToDpc
ObQueryNameString
CmRegisterCallback
CmUnRegisterCallback
ZwReadFile
ZwQueryInformationFile
KeBugCheckEx
KeSetEvent
RtlUpcaseUnicodeString
MmBuildMdlForNonPagedPool
MmForceSectionClosed
FsRtlTeardownPerStreamContexts
RtlCopyUnicodeString
ZwOpenKey
IoAllocateMdl
DbgPrint
MmProbeAndLockPages
RtlTimeToTimeFields
KeWaitForSingleObject
RtlAppendUnicodeStringToString
_vsnwprintf
ZwQueryValueKey
ExSystemTimeToLocalTime
MmMapLockedPagesSpecifyCache
IoFreeMdl
RtlAppendUnicodeToString
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
RtlSetDaclSecurityDescriptor
ExInitializeNPagedLookasideList
FsRtlUninitializeFileLock
ZwQueryInformationToken
ExInitializeResourceLite
ObfDereferenceObject
MmIsAddressValid
PsGetCurrentThreadId
ExDeleteResourceLite
RtlCompareUnicodeString
ZwClose
ExReleaseResourceLite
IoVolumeDeviceToDosName
ZwOpenProcessTokenEx
CcFlushCache
RtlValidSid
KeInitializeEvent
CcUninitializeCacheMap
ExAcquireFastMutex
ZwOpenThreadTokenEx
ExReleaseFastMutex
ExAcquireResourceExclusiveLite
MmSystemRangeStart
RtlCompareMemory
RtlLengthSecurityDescriptor
PsGetCurrentProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoWMIWriteEvent
ExFreePoolWithTag
IoWMIRegistrationControl
RtlInitializeGenericTable
ExAllocatePoolWithTag
PsGetVersion
__C_specific_handler
_local_unwind

fltmgr.sys

FltSendMessage
FltUnregisterFilter
FltRegisterFilter
FltStartFiltering
FltGetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetFileNameInformationUnsafe
FltCheckAndGrowNameControl
FltReadFile
FltSetInformationFile
FltInitializeOplock
FltWriteFile
FltAllocatePoolAlignedWithTag
FltDoCompletionProcessingWhenSafe
FltLockUserBuffer
FltAllocateCallbackData
FltPerformSynchronousIo
FltFreeCallbackData
FltIsDirectory
FltGetRoutineAddress
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltCreateFile
FltFreeSecurityDescriptor
FltCreateCommunicationPort
FltCloseClientPort
FltSetCallbackDataDirty
FltFreePoolAlignedWithTag
FltParseFileNameInformation
FltReleaseFileNameInformation
FltAcquireResourceExclusive
FltUninitializeOplock
FltGetVolumeName
FltGetFileNameInformation
FltAllocateContext
FltClose
FltReleaseContext
FltReleaseResource
FltQueryInformationFile
FltGetVolumeProperties
FltGetDiskDeviceObject
FltSetInstanceContext
FltDeleteContext
FltGetDestinationFileNameInformation
FltSetStreamContext
FltReferenceContext
FltGetRequestorProcessId
FltDeleteInstanceContext
FltSetStreamHandleContext

ksecdd.sys

SecLookupAccountSid

cng.sys

BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptDestroyKey
BCryptEncrypt
BCryptGetProperty

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 618B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/x64/EaseFltCPPDemo.exe
.exe windows:5 windows x64 arch:x64

d75ed198aa54007cbaf3ee976e0a5261

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fe:1f:6e:06:f9:f5:5e:77:f4:42:a4:f9:1f:f5:5b:64:9a:e8:fb:ca:38:e6:94:29:9c:bc:a5:40:04:c5:ea:70
Signer

Actual PE Digest

fe:1f:6e:06:f9:f5:5e:77:f4:42:a4:f9:1f:f5:5b:64:9a:e8:fb:ca:38:e6:94:29:9c:bc:a5:40:04:c5:ea:70

Digest Algorithm

sha256

PE Digest Matches

true

87:93:98:aa:88:70:c1:6e:d7:df:47:5a:11:87:0e:4c:f3:d5:5e:81
Signer

Actual PE Digest

87:93:98:aa:88:70:c1:6e:d7:df:47:5a:11:87:0e:4c:f3:d5:5e:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Development\Release\EaseFltCPPDemo.pdb

Imports

filterapi

GetUniqueComputerId
UnInstallDriver
InstallDriver
SetRegistrationKey
RegisterMessageCallback
Disconnect
IsDriverServiceRunning
SetConnectionTimeout
SetFilterType
AddProcessFilterRule
AddFileControlToProcessByName
AddRegistryFilterRule
AddNewFilterRule
RemoveBlockSaveAsProcessId
AddExcludeFileMaskToFilterRule
AESDecryptFileWithKey
RegisterIoRequest
SetBooleanConfig
AddIncludeProcessIdToFilterRule
AddIncludeUserNameToFilterRule
AddFileFilterRule
RegisterFileChangedEventsToFilterRule
RegisterMonitorIOToFilterRule
RegisterControlIOToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddBooleanConfigToFilterRule
SetVolumeControlFlag
AddExcludedProcessId
GetLastErrorMessage
AESDecryptFile
AESEncryptFile
SetFileSize
ResetConfigData
RemoveProcessIdRightsFromFilterRule
AddProcessIdRightsToFilterRule
GetAESHeader
AddReparseFileMaskToFilterRule

kernel32

Sleep
DeleteFileW
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetFileInformationByHandle
MoveFileW
SetFilePointer
SetEndOfFile
FindFirstFileW
FindClose
GetFileTime
GetFileAttributesW
FindNextFileW
GetStdHandle
SetConsoleTextAttribute
OutputDebugStringW
FormatMessageW
LocalFree
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
GetFileSizeEx
GetCurrentProcessId
ReadFile
CloseHandle
WriteFile
CreateFileW
GetLastError
CreateDirectoryW
WideCharToMultiByte
HeapAlloc
HeapFree
GetCommandLineW
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
HeapSize
HeapReAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetFileAttributesA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetExitCodeProcess
CreateProcessA
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW

advapi32

RegisterServiceCtrlHandlerW
GetFileSecurityW
SetFileSecurityW
GetUserNameW
StartServiceCtrlDispatcherW
SetServiceStatus
LookupAccountSidW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/x64/FilterAPI.dll
.dll windows:5 windows x64 arch:x64

a868be19be7845c81e1a1ebf14031fb0

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ad:7c:8a:31:d6:7c:ea:a6:9a:ff:fd:21:d9:e3:f2:20:46:2e:fd:18:34:5e:45:83:70:d7:6d:e6:1f:88:d9:03
Signer

Actual PE Digest

ad:7c:8a:31:d6:7c:ea:a6:9a:ff:fd:21:d9:e3:f2:20:46:2e:fd:18:34:5e:45:83:70:d7:6d:e6:1f:88:d9:03

Digest Algorithm

sha256

PE Digest Matches

true

1e:cd:d8:d0:70:bd:bb:d8:eb:a6:59:fd:4b:4e:a7:01:bc:e6:e0:61
Signer

Actual PE Digest

1e:cd:d8:d0:70:bd:bb:d8:eb:a6:59:fd:4b:4e:a7:01:bc:e6:e0:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Development\Release\x64\FilterAPI.pdb

Imports

fltlib

FilterConnectCommunicationPort
FilterGetMessage
FilterReplyMessage
FilterLoad
FilterUnload
FilterSendMessage

kernel32

GetModuleFileNameW
SystemTimeToFileTime
GetComputerNameW
GetCurrentProcessId
GetSystemTime
SetEndOfFile
SetFileTime
DeviceIoControl
GetFileTime
MultiByteToWideChar
lstrcmpA
LocalAlloc
lstrcpyW
Process32FirstW
ResetEvent
SetLastError
GetOverlappedResult
OpenProcess
GetCurrentProcess
FormatMessageW
OutputDebugStringW
GetModuleHandleW
SetFileAttributesW
LocalFree
DeleteFileW
CloseHandle
BackupRead
CopyFileW
GetFileSizeEx
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetConsoleMode
GetConsoleCP
SetFilePointer
FlushFileBuffers
GetLocaleInfoW
LoadLibraryW
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
BackupSeek
SetFilePointerEx
Sleep
GetSystemDirectoryW
CreateThread
CreateToolhelp32Snapshot
Process32NextW
GetLastError
CreateEventW
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetProcAddress
ExitProcess
DecodePointer
GetStdHandle
EncodePointer
FlsGetValue
FlsFree
GetCurrentThread
FlsAlloc
HeapSize
HeapQueryInformation
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection

advapi32

OpenEventLogW
CloseEventLog
OpenProcessToken
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
CloseServiceHandle
DeleteService
EnumServicesStatusExW
RegSetValueExW
RegCloseKey
ControlService
QueryServiceStatus
RegDeleteKeyW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
ReportEventW

rpcrt4

UuidCreate

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptGetProperty

psapi

GetModuleFileNameExW

ntdll

NtSetInformationFile
NtQueryInformationFile
RtlNtStatusToDosError
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx

crypt32

CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

Exports

Exports

AESDecryptBytes
AESDecryptFile
AESDecryptFileToFile
AESDecryptFileWithKey
AESEncryptDecryptBuffer
AESEncryptFile
AESEncryptFileToFile
AESEncryptFileToFileWithTag
AESEncryptFileWithTag
ActivateLicense
AddAESHeader
AddBlockSaveAsProcessId
AddBooleanConfigToFilterRule
AddCreateFilterToFilterRule
AddEncryptionKeyAndIVToFilterRule
AddEncryptionKeyToFilterRule
AddExcludeFileMaskToFilterRule
AddExcludeProcessIdToFilterRule
AddExcludeProcessNameToFilterRule
AddExcludeUserNameToFilterRule
AddExcludedProcessId
AddFileCallbackIOToProcessByName
AddFileControlToProcessById
AddFileControlToProcessByName
AddFileFilterRule
AddFilterRule
AddHiddenFileMaskToFilterRule
AddIncludeProcessIdToFilterRule
AddIncludeProcessNameToFilterRule
AddIncludeUserNameToFilterRule
AddIncludedProcessId
AddNewFilterRule
AddProcessFilterRule
AddProcessIdRightsToFilterRule
AddProcessRightsToFilterRule
AddProtectedProcessId
AddRegistryFilterRule
AddRegistryFilterRuleByProcessId
AddRegistryFilterRuleByProcessName
AddReparseFileMaskToFilterRule
AddReparseTagData
AddTagData
AddUserRightsToFilterRule
CloseFileHandleInFilter
CreateFileAPI
CreateStubFile
CreateStubFileEx
Disconnect
EnableReparsePointTagEncryption
GetAESHeader
GetAESIV
GetAESTagData
GetFileHandleInFilter
GetLastErrorMessage
GetTagData
GetUniqueComputerId
InstallDriver
IsDriverServiceRunning
OpenStubFile
QueryAllocatedRanges
RegisterControlIOToFilterRule
RegisterEventTypeToFilterRule
RegisterFileChangedEventsToFilterRule
RegisterIoRequest
RegisterMessageCallback
RegisterMonitorIOToFilterRule
RemoveBlockSaveAsProcessId
RemoveBooleanConfigFromFilterRule
RemoveExcludeProcessId
RemoveFileControlFromProcessById
RemoveFileControlFromProcessByName
RemoveFilterRule
RemoveIncludeProcessId
RemoveProcessFilterRule
RemoveProcessIdRightsFromFilterRule
RemoveProcessRightsFromFilterRule
RemoveProtectedProcessId
RemoveRegistryFilterRuleByProcessId
RemoveRegistryFilterRuleByProcessName
RemoveTagData
ResetConfigData
SetAESHeaderSize
SetAESVersion
SetBooleanConfig
SetConnectionTimeout
SetFileSize
SetFilterType
SetHeaderFlags
SetIntegerData
SetMaxMonitorEventBuffersize
SetRegistrationKey
SetStringData
SetVolumeControlFlag
UnInstallDriver

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bin/x64/FilterAPI.lib
CommonObjects.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:fb:4f:ab:ec:d9:a9:d3:05:bf:8c:a7:54:0f:2f:07:2c:f8:d8:55:37:e9:29:04:b4:e3:fa:68:e6:1f:db:2b
Signer

Actual PE Digest

47:fb:4f:ab:ec:d9:a9:d3:05:bf:8c:a7:54:0f:2f:07:2c:f8:d8:55:37:e9:29:04:b4:e3:fa:68:e6:1f:db:2b

Digest Algorithm

sha256

PE Digest Matches

true

4e:d7:ff:75:c3:4b:2c:44:11:76:12:07:03:fa:cb:6f:66:a2:af:e7
Signer

Actual PE Digest

4e:d7:ff:75:c3:4b:2c:44:11:76:12:07:03:fa:cb:6f:66:a2:af:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Development\Demo\CommonObjects\obj\Release\CommonObjects.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Demo_Source_Code/AutoEncryptDemo/AutoEncryptDemo.csproj
Demo_Source_Code/AutoEncryptDemo/AutoEncryptForm.Designer.cs
Demo_Source_Code/AutoEncryptDemo/AutoEncryptForm.cs
.js
Demo_Source_Code/AutoEncryptDemo/AutoEncryptForm.resx
.vbs
Demo_Source_Code/AutoEncryptDemo/Program.cs
Demo_Source_Code/AutoEncryptDemo/Properties/AssemblyInfo.cs
Demo_Source_Code/AutoEncryptDemo/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/AutoEncryptDemo/Properties/Resources.resx
.vbs
Demo_Source_Code/AutoEncryptDemo/Properties/Settings.Designer.cs
Demo_Source_Code/AutoEncryptDemo/Properties/Settings.settings
Demo_Source_Code/AutoEncryptDemo/app.config
.xml
Demo_Source_Code/AutoEncryptDemo/app.manifest
Demo_Source_Code/AutoFileCryptTool/AutoFileCryptTool.csproj
Demo_Source_Code/AutoFileCryptTool/BlackListForm.Designer.cs
Demo_Source_Code/AutoFileCryptTool/BlackListForm.cs
Demo_Source_Code/AutoFileCryptTool/BlackListForm.resx
.vbs .xml polyglot
Demo_Source_Code/AutoFileCryptTool/DropFolderForm.Designer.cs
Demo_Source_Code/AutoFileCryptTool/DropFolderForm.cs
Demo_Source_Code/AutoFileCryptTool/DropFolderForm.resx
.vbs .xml polyglot
Demo_Source_Code/AutoFileCryptTool/FilterDriverService.cs
.js
Demo_Source_Code/AutoFileCryptTool/FormFileCrypt.Designer.cs
Demo_Source_Code/AutoFileCryptTool/FormFileCrypt.cs
.js
Demo_Source_Code/AutoFileCryptTool/FormFileCrypt.resx
.vbs
Demo_Source_Code/AutoFileCryptTool/PasswordForm.Designer.cs
Demo_Source_Code/AutoFileCryptTool/PasswordForm.cs
Demo_Source_Code/AutoFileCryptTool/PasswordForm.resx
.vbs .xml polyglot
Demo_Source_Code/AutoFileCryptTool/Program.cs
Demo_Source_Code/AutoFileCryptTool/Properties/AssemblyInfo.cs
Demo_Source_Code/AutoFileCryptTool/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/AutoFileCryptTool/Properties/Resources.resx
.vbs
Demo_Source_Code/AutoFileCryptTool/Properties/Settings.Designer.cs
Demo_Source_Code/AutoFileCryptTool/Properties/Settings.settings
Demo_Source_Code/AutoFileCryptTool/Resources/about.png
.png
Demo_Source_Code/AutoFileCryptTool/SetupPasswordForm.Designer.cs
Demo_Source_Code/AutoFileCryptTool/SetupPasswordForm.cs
Demo_Source_Code/AutoFileCryptTool/SetupPasswordForm.resx
.vbs
Demo_Source_Code/AutoFileCryptTool/TrayForm.Designer.cs
Demo_Source_Code/AutoFileCryptTool/TrayForm.cs
.ps1
Demo_Source_Code/AutoFileCryptTool/TrayForm.resx
.vbs
Demo_Source_Code/AutoFileCryptTool/VerifyPassword.Designer.cs
Demo_Source_Code/AutoFileCryptTool/VerifyPassword.cs
Demo_Source_Code/AutoFileCryptTool/VerifyPassword.resx
.vbs
Demo_Source_Code/AutoFileCryptTool/app.config
.xml
Demo_Source_Code/AutoFileCryptTool/app.manifest
Demo_Source_Code/AutoFileCryptTool/encrypt.ico
Demo_Source_Code/CommonObjects/AccessRightsForm.Designer.cs
Demo_Source_Code/CommonObjects/AccessRightsForm.cs
Demo_Source_Code/CommonObjects/AccessRightsForm.resx
.vbs
Demo_Source_Code/CommonObjects/CommonObjects.csproj
Demo_Source_Code/CommonObjects/ConfigSetting.cs
Demo_Source_Code/CommonObjects/ControlFilterRuleSettigs.Designer.cs
Demo_Source_Code/CommonObjects/ControlFilterRuleSettigs.cs
Demo_Source_Code/CommonObjects/ControlFilterRuleSettigs.resx
.vbs
Demo_Source_Code/CommonObjects/EventForm.Designer.cs
Demo_Source_Code/CommonObjects/EventForm.cs
.js
Demo_Source_Code/CommonObjects/EventForm.resx
.vbs
Demo_Source_Code/CommonObjects/EventManager.cs
.js
Demo_Source_Code/CommonObjects/FilterAPI.cs
Demo_Source_Code/CommonObjects/FilterRuleForm.Designer.cs
Demo_Source_Code/CommonObjects/FilterRuleForm.cs
Demo_Source_Code/CommonObjects/FilterRuleForm.resx
.vbs
Demo_Source_Code/CommonObjects/FilterRuleSection.cs
.js
Demo_Source_Code/CommonObjects/GlobalConfig.cs
.vbs
Demo_Source_Code/CommonObjects/MessageBoxHelper.cs
Demo_Source_Code/CommonObjects/OptionForm.cs
Demo_Source_Code/CommonObjects/OptionForm.designer.cs
Demo_Source_Code/CommonObjects/OptionForm.resx
.vbs .xml polyglot
Demo_Source_Code/CommonObjects/ProcessFilterRuleSection.cs
Demo_Source_Code/CommonObjects/ProcessFilterSettingForm.Designer.cs
Demo_Source_Code/CommonObjects/ProcessFilterSettingForm.cs
.js
Demo_Source_Code/CommonObjects/ProcessFilterSettingForm.resx
.vbs
Demo_Source_Code/CommonObjects/Properties/AssemblyInfo.cs
Demo_Source_Code/CommonObjects/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/CommonObjects/Properties/Resources.resx
.vbs
Demo_Source_Code/CommonObjects/RegistryAccessControlForm.Designer.cs
Demo_Source_Code/CommonObjects/RegistryAccessControlForm.cs
.js
Demo_Source_Code/CommonObjects/RegistryAccessControlForm.resx
.vbs
Demo_Source_Code/CommonObjects/RegistryAccessControlHandler.cs
.js
Demo_Source_Code/CommonObjects/RegistryFilterRuleSection.cs
Demo_Source_Code/CommonObjects/RegistryUnitTest.cs
.js
Demo_Source_Code/CommonObjects/Resources/about.png
.png
Demo_Source_Code/CommonObjects/SettingsForm.Designer.cs
Demo_Source_Code/CommonObjects/SettingsForm.cs
.js
Demo_Source_Code/CommonObjects/SettingsForm.resx
.vbs
Demo_Source_Code/CommonObjects/app.config
Demo_Source_Code/Demo.sln
Demo_Source_Code/EaseFltCPPDemo/AESEncryption.cpp
Demo_Source_Code/EaseFltCPPDemo/AESEncryption.h
Demo_Source_Code/EaseFltCPPDemo/CPlusPlusDemo.cpp
Demo_Source_Code/EaseFltCPPDemo/CPlusPlusDemo.rc
Demo_Source_Code/EaseFltCPPDemo/ControlFilterHandler.cpp
.js
Demo_Source_Code/EaseFltCPPDemo/ControlFilterHandler.h
Demo_Source_Code/EaseFltCPPDemo/EaseFltCPPDemo.vcxproj
Demo_Source_Code/EaseFltCPPDemo/EaseFltCPPDemo.vcxproj.filters
Demo_Source_Code/EaseFltCPPDemo/EaseFltCPPDemo.vcxproj.user
Demo_Source_Code/EaseFltCPPDemo/FeatureDemo.cpp
Demo_Source_Code/EaseFltCPPDemo/FilterAPI.h
Demo_Source_Code/EaseFltCPPDemo/FilterMessage.cpp
Demo_Source_Code/EaseFltCPPDemo/FilterMessage.h
Demo_Source_Code/EaseFltCPPDemo/FilterWorker.cpp
Demo_Source_Code/EaseFltCPPDemo/FilterWorker.h
Demo_Source_Code/EaseFltCPPDemo/ProcessFilterTest.cpp
Demo_Source_Code/EaseFltCPPDemo/ProcessFilterTest.h
Demo_Source_Code/EaseFltCPPDemo/ReadMe.txt
Demo_Source_Code/EaseFltCPPDemo/RegistryFilterTest.cpp
Demo_Source_Code/EaseFltCPPDemo/RegistryFilterTest.h
Demo_Source_Code/EaseFltCPPDemo/Tools.cpp
Demo_Source_Code/EaseFltCPPDemo/Tools.h
Demo_Source_Code/EaseFltCPPDemo/UnitTest.cpp
Demo_Source_Code/EaseFltCPPDemo/UnitTest.h
Demo_Source_Code/EaseFltCPPDemo/WinDataStructures.h
Demo_Source_Code/EaseFltCPPDemo/WindowsService.cpp
Demo_Source_Code/EaseFltCPPDemo/WindowsService.h
Demo_Source_Code/EaseFltCPPDemo/afxres.h
Demo_Source_Code/EaseFltCPPDemo/resource.h
Demo_Source_Code/EaseFltCPPDemo/stdafx.cpp
Demo_Source_Code/EaseFltCPPDemo/stdafx.h
Demo_Source_Code/EaseFltCPPDemo/targetver.h
Demo_Source_Code/EaseFltCSConsoleDemo/ControlEventHandler.cs
.js
Demo_Source_Code/EaseFltCSConsoleDemo/EaseFilterService.Designer.cs
Demo_Source_Code/EaseFltCSConsoleDemo/EaseFilterService.cs
Demo_Source_Code/EaseFltCSConsoleDemo/EaseFltCSConsoleDemo.csproj
Demo_Source_Code/EaseFltCSConsoleDemo/FilterWorker.cs
.js
Demo_Source_Code/EaseFltCSConsoleDemo/MonitorEventHandler.cs
.js
Demo_Source_Code/EaseFltCSConsoleDemo/ProcessHandler.cs
.js
Demo_Source_Code/EaseFltCSConsoleDemo/Program.cs
.js
Demo_Source_Code/EaseFltCSConsoleDemo/Properties/AssemblyInfo.cs
Demo_Source_Code/EaseFltCSConsoleDemo/RegistryHandler.cs
.js
Demo_Source_Code/EaseFltCSConsoleDemo/ServiceInstaller.cs
Demo_Source_Code/EaseFltCSConsoleDemo/app.config
.xml
Demo_Source_Code/FileMonitor/FileMonitor.csproj
Demo_Source_Code/FileMonitor/Monitor.ico
Demo_Source_Code/FileMonitor/MonitorEventHandler.cs
.js
Demo_Source_Code/FileMonitor/MonitorForm.Designer.cs
Demo_Source_Code/FileMonitor/MonitorForm.cs
.js
Demo_Source_Code/FileMonitor/MonitorForm.resx
.vbs
Demo_Source_Code/FileMonitor/MonitorUnitTest.Designer.cs
Demo_Source_Code/FileMonitor/MonitorUnitTest.cs
.js
Demo_Source_Code/FileMonitor/MonitorUnitTest.resx
.vbs
Demo_Source_Code/FileMonitor/Program.cs
Demo_Source_Code/FileMonitor/Properties/AssemblyInfo.cs
Demo_Source_Code/FileMonitor/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/FileMonitor/Properties/Resources.resx
.vbs
Demo_Source_Code/FileMonitor/Properties/Settings.Designer.cs
Demo_Source_Code/FileMonitor/Properties/Settings.settings
Demo_Source_Code/FileMonitor/TrayForm.Designer.cs
Demo_Source_Code/FileMonitor/TrayForm.cs
.ps1
Demo_Source_Code/FileMonitor/TrayForm.resx
.vbs
Demo_Source_Code/FileMonitor/app.config
Demo_Source_Code/FileMonitor/app.manifest
Demo_Source_Code/FileMonitor/text_view.ico
Demo_Source_Code/FileMonitorConsole/FileMonitorConsole.csproj
Demo_Source_Code/FileMonitorConsole/Program.cs
.js
Demo_Source_Code/FileMonitorConsole/Properties/AssemblyInfo.cs
Demo_Source_Code/FileMonitorConsole/app.config
.xml
Demo_Source_Code/FileProtector/ControlEventHandler.cs
.js
Demo_Source_Code/FileProtector/DecryptionForm.Designer.cs
Demo_Source_Code/FileProtector/DecryptionForm.cs
Demo_Source_Code/FileProtector/DecryptionForm.resx
.vbs
Demo_Source_Code/FileProtector/EncryptEventHandler.cs
Demo_Source_Code/FileProtector/EncryptionForm.Designer.cs
Demo_Source_Code/FileProtector/EncryptionForm.cs
Demo_Source_Code/FileProtector/EncryptionForm.resx
.vbs
Demo_Source_Code/FileProtector/FileIOControlService.cs
.js
Demo_Source_Code/FileProtector/FileProtector.csproj
Demo_Source_Code/FileProtector/FileProtector.csproj.user
Demo_Source_Code/FileProtector/InputForm.Designer.cs
Demo_Source_Code/FileProtector/InputForm.cs
Demo_Source_Code/FileProtector/InputForm.resx
.vbs .xml polyglot
Demo_Source_Code/FileProtector/MonitorEventHandler.cs
.js
Demo_Source_Code/FileProtector/Program.cs
Demo_Source_Code/FileProtector/Properties/AssemblyInfo.cs
Demo_Source_Code/FileProtector/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/FileProtector/Properties/Resources.resx
.vbs
Demo_Source_Code/FileProtector/Properties/Settings.Designer.cs
Demo_Source_Code/FileProtector/Properties/Settings.settings
Demo_Source_Code/FileProtector/ProtectorForm.Designer.cs
Demo_Source_Code/FileProtector/ProtectorForm.cs
.js
Demo_Source_Code/FileProtector/ProtectorForm.resx
.vbs
Demo_Source_Code/FileProtector/ProtectorUnitTest.Designer.cs
Demo_Source_Code/FileProtector/ProtectorUnitTest.cs
.js
Demo_Source_Code/FileProtector/ProtectorUnitTest.resx
.vbs
Demo_Source_Code/FileProtector/TutorialForm.Designer.cs
Demo_Source_Code/FileProtector/TutorialForm.cs
Demo_Source_Code/FileProtector/TutorialForm.resx
.vbs
Demo_Source_Code/FileProtector/app.config
.xml
Demo_Source_Code/FileProtector/app.manifest
Demo_Source_Code/FileProtector/protector.ico
Demo_Source_Code/FileProtectorConsole/FileProtectorConsole.csproj
Demo_Source_Code/FileProtectorConsole/Program.cs
.js
Demo_Source_Code/FileProtectorConsole/Properties/AssemblyInfo.cs
Demo_Source_Code/FileProtectorConsole/app.config
.xml
Demo_Source_Code/FilterControl/ControlFilter.cs
.vbs
Demo_Source_Code/FilterControl/EncryptionFilter.cs
.vbs
Demo_Source_Code/FilterControl/FileFilter.cs
.vbs
Demo_Source_Code/FilterControl/FilterAPI.cs
Demo_Source_Code/FilterControl/FilterComponent.cs
.js
Demo_Source_Code/FilterControl/FilterControl.csproj
Demo_Source_Code/FilterControl/FilterControl2015.csproj
Demo_Source_Code/FilterControl/MonitorFilter.cs
.js
Demo_Source_Code/FilterControl/NtStatus.cs
Demo_Source_Code/FilterControl/ProcessFilter.cs
Demo_Source_Code/FilterControl/Properties/AssemblyInfo.cs
Demo_Source_Code/FilterControl/RegistryFilter.cs
.js
Demo_Source_Code/FilterControl/Utils.cs
.js
Demo_Source_Code/FilterControl/WinDataStructures.cs
Demo_Source_Code/FolderLocker/AccessRightsForm.Designer.cs
Demo_Source_Code/FolderLocker/AccessRightsForm.cs
Demo_Source_Code/FolderLocker/AccessRightsForm.resx
.vbs
Demo_Source_Code/FolderLocker/AccountForm.Designer.cs
Demo_Source_Code/FolderLocker/AccountForm.cs
.js
Demo_Source_Code/FolderLocker/AccountForm.resx
.vbs
Demo_Source_Code/FolderLocker/DRServer.cs
.js
Demo_Source_Code/FolderLocker/EncryptEventHandler.cs
Demo_Source_Code/FolderLocker/FolderLocker.csproj
Demo_Source_Code/FolderLocker/FolderLockerSettigs.Designer.cs
Demo_Source_Code/FolderLocker/FolderLockerSettigs.cs
Demo_Source_Code/FolderLocker/FolderLockerSettigs.resx
.vbs
Demo_Source_Code/FolderLocker/FormFolderLocker.Designer.cs
Demo_Source_Code/FolderLocker/FormFolderLocker.cs
.js
Demo_Source_Code/FolderLocker/FormFolderLocker.resx
.vbs
Demo_Source_Code/FolderLocker/Lock Folder.ico
Demo_Source_Code/FolderLocker/Program.cs
Demo_Source_Code/FolderLocker/Properties/AssemblyInfo.cs
Demo_Source_Code/FolderLocker/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/FolderLocker/Properties/Resources.resx
.vbs
Demo_Source_Code/FolderLocker/Properties/Settings.Designer.cs
Demo_Source_Code/FolderLocker/Properties/Settings.settings
Demo_Source_Code/FolderLocker/Service References/ServiceReference1/Reference.cs
Demo_Source_Code/FolderLocker/Service References/ServiceReference1/Reference.svcmap
.xml
Demo_Source_Code/FolderLocker/Service References/ServiceReference1/configuration.svcinfo
Demo_Source_Code/FolderLocker/Service References/ServiceReference1/configuration91.svcinfo
.xml
Demo_Source_Code/FolderLocker/Service References/ServiceReference1/webapi.disco
.xml
Demo_Source_Code/FolderLocker/Service References/ServiceReference1/webapi.wsdl
.xml
Demo_Source_Code/FolderLocker/ShareFileForm.Designer.cs
Demo_Source_Code/FolderLocker/ShareFileForm.cs
.js
Demo_Source_Code/FolderLocker/ShareFileForm.resx
.vbs
Demo_Source_Code/FolderLocker/ShareFileManager.cs
Demo_Source_Code/FolderLocker/SharedFileAccessLogForm.Designer.cs
Demo_Source_Code/FolderLocker/SharedFileAccessLogForm.cs
Demo_Source_Code/FolderLocker/SharedFileAccessLogForm.resx
.vbs
Demo_Source_Code/FolderLocker/WebAPIService.cs
.js
Demo_Source_Code/FolderLocker/WebAPIService.designer.cs
Demo_Source_Code/FolderLocker/WebAPIService.resx
.vbs
Demo_Source_Code/FolderLocker/app.config
.xml
Demo_Source_Code/FolderLocker/app.manifest
Demo_Source_Code/ProcessMon/ProcessFileAccessRights.Designer.cs
Demo_Source_Code/ProcessMon/ProcessFileAccessRights.cs
Demo_Source_Code/ProcessMon/ProcessFileAccessRights.resx
.vbs
Demo_Source_Code/ProcessMon/ProcessFilterSetting.Designer.cs
Demo_Source_Code/ProcessMon/ProcessFilterSetting.cs
Demo_Source_Code/ProcessMon/ProcessFilterSetting.resx
.vbs
Demo_Source_Code/ProcessMon/ProcessFilterSettingCollection.Designer.cs
Demo_Source_Code/ProcessMon/ProcessFilterSettingCollection.cs
.js
Demo_Source_Code/ProcessMon/ProcessFilterSettingCollection.resx
.vbs
Demo_Source_Code/ProcessMon/ProcessHandler.cs
.js
Demo_Source_Code/ProcessMon/ProcessMon.Designer.cs
Demo_Source_Code/ProcessMon/ProcessMon.cs
.js
Demo_Source_Code/ProcessMon/ProcessMon.csproj
Demo_Source_Code/ProcessMon/ProcessMon.resx
.vbs
Demo_Source_Code/ProcessMon/ProcessUnitTest.cs
.js
Demo_Source_Code/ProcessMon/ProcessUnitTestForm.Designer.cs
Demo_Source_Code/ProcessMon/ProcessUnitTestForm.cs
Demo_Source_Code/ProcessMon/ProcessUnitTestForm.resx
.vbs
Demo_Source_Code/ProcessMon/Program.cs
Demo_Source_Code/ProcessMon/Properties/AssemblyInfo.cs
Demo_Source_Code/ProcessMon/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/ProcessMon/Properties/Resources.resx
.vbs
Demo_Source_Code/ProcessMon/Properties/Settings.Designer.cs
Demo_Source_Code/ProcessMon/Properties/Settings.settings
Demo_Source_Code/ProcessMon/about.png
.png
Demo_Source_Code/ProcessMon/app.config
.xml
Demo_Source_Code/ProcessMon/app.manifest
Demo_Source_Code/ProcessMon/processmon.ico
Demo_Source_Code/RegMon/Program.cs
Demo_Source_Code/RegMon/Properties/AssemblyInfo.cs
Demo_Source_Code/RegMon/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/RegMon/Properties/Resources.resx
.vbs
Demo_Source_Code/RegMon/Properties/Settings.Designer.cs
Demo_Source_Code/RegMon/Properties/Settings.settings
Demo_Source_Code/RegMon/RegMon.csproj
Demo_Source_Code/RegMon/RegMonForm.Designer.cs
Demo_Source_Code/RegMon/RegMonForm.cs
.js
Demo_Source_Code/RegMon/RegMonForm.resx
.vbs
Demo_Source_Code/RegMon/RegUnitTest.Designer.cs
Demo_Source_Code/RegMon/RegUnitTest.cs
.js
Demo_Source_Code/RegMon/RegUnitTest.resx
.vbs
Demo_Source_Code/RegMon/RegistryAccessControlForm.Designer.cs
Demo_Source_Code/RegMon/RegistryAccessControlForm.cs
.js
Demo_Source_Code/RegMon/RegistryAccessControlForm.resx
.vbs
Demo_Source_Code/RegMon/RegistryHandler.cs
.js
Demo_Source_Code/RegMon/RegistryUnitTest.cs
.js
Demo_Source_Code/RegMon/app.config
.xml
Demo_Source_Code/RegMon/app.manifest
Demo_Source_Code/RegMon/registry-icon.ico
Demo_Source_Code/SecureSandbox/AuthorizedProcessForm.Designer.cs
Demo_Source_Code/SecureSandbox/AuthorizedProcessForm.cs
Demo_Source_Code/SecureSandbox/AuthorizedProcessForm.resx
.vbs
Demo_Source_Code/SecureSandbox/EncryptEventHandler.cs
Demo_Source_Code/SecureSandbox/Info.png
.png
Demo_Source_Code/SecureSandbox/ProcessFileAccessRights.Designer.cs
Demo_Source_Code/SecureSandbox/ProcessFileAccessRights.cs
Demo_Source_Code/SecureSandbox/ProcessFileAccessRights.resx
.vbs
Demo_Source_Code/SecureSandbox/Program.cs
Demo_Source_Code/SecureSandbox/Properties/AssemblyInfo.cs
Demo_Source_Code/SecureSandbox/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/SecureSandbox/Properties/Resources.resx
.vbs
Demo_Source_Code/SecureSandbox/Properties/Settings.Designer.cs
Demo_Source_Code/SecureSandbox/Properties/Settings.settings
Demo_Source_Code/SecureSandbox/SecureSandbox.Designer.cs
Demo_Source_Code/SecureSandbox/SecureSandbox.cs
.js
Demo_Source_Code/SecureSandbox/SecureSandbox.csproj
Demo_Source_Code/SecureSandbox/SecureSandbox.ico
Demo_Source_Code/SecureSandbox/SecureSandbox.resx
.vbs
Demo_Source_Code/SecureSandbox/TrayForm.Designer.cs
Demo_Source_Code/SecureSandbox/TrayForm.cs
Demo_Source_Code/SecureSandbox/TrayForm.resx
.vbs
Demo_Source_Code/SecureSandbox/about.png
.png
Demo_Source_Code/SecureSandbox/app.config
.xml
Demo_Source_Code/SecureSandbox/app.manifest
Demo_Source_Code/SecureShare/ConsoleForm.Designer.cs
Demo_Source_Code/SecureShare/ConsoleForm.cs
.js
Demo_Source_Code/SecureShare/ConsoleForm.resx
.vbs
Demo_Source_Code/SecureShare/CreateShareEncryptedFileForm.Designer.cs
Demo_Source_Code/SecureShare/CreateShareEncryptedFileForm.cs
Demo_Source_Code/SecureShare/CreateShareEncryptedFileForm.resx
.vbs
Demo_Source_Code/SecureShare/DRServer.cs
.js
Demo_Source_Code/SecureShare/EncryptEventHandler.cs
.js
Demo_Source_Code/SecureShare/Program.cs
Demo_Source_Code/SecureShare/Properties/AssemblyInfo.cs
Demo_Source_Code/SecureShare/Properties/Resources.Designer.cs
.vbs
Demo_Source_Code/SecureShare/Properties/Resources.resx
.vbs
Demo_Source_Code/SecureShare/Properties/Settings.Designer.cs
Demo_Source_Code/SecureShare/Properties/Settings.settings
Demo_Source_Code/SecureShare/SecureForm.Designer.cs
Demo_Source_Code/SecureShare/SecureForm.cs
Demo_Source_Code/SecureShare/SecureForm.resx
.vbs
Demo_Source_Code/SecureShare/SecureShare.csproj
Demo_Source_Code/SecureShare/SecureShare.csproj.user
Demo_Source_Code/SecureShare/SecureShareManager.ico
Demo_Source_Code/SecureShare/Service References/ServiceReference1/Reference.cs
Demo_Source_Code/SecureShare/Service References/ServiceReference1/Reference.svcmap
.xml
Demo_Source_Code/SecureShare/Service References/ServiceReference1/configuration.svcinfo
Demo_Source_Code/SecureShare/Service References/ServiceReference1/configuration91.svcinfo
.xml
Demo_Source_Code/SecureShare/Service References/ServiceReference1/webapi.disco
.xml
Demo_Source_Code/SecureShare/Service References/ServiceReference1/webapi.wsdl
.xml
Demo_Source_Code/SecureShare/ShareFileForm.Designer.cs
Demo_Source_Code/SecureShare/ShareFileForm.cs
.js
Demo_Source_Code/SecureShare/ShareFileForm.resx
.vbs
Demo_Source_Code/SecureShare/ShareFileManagerInLocal.Designer.cs
Demo_Source_Code/SecureShare/ShareFileManagerInLocal.cs
.js
Demo_Source_Code/SecureShare/ShareFileManagerInLocal.resx
.vbs
Demo_Source_Code/SecureShare/ShareFileManagerInServer.Designer.cs
Demo_Source_Code/SecureShare/ShareFileManagerInServer.cs
Demo_Source_Code/SecureShare/ShareFileManagerInServer.resx
.vbs
Demo_Source_Code/SecureShare/ShareFileSettingForm.Designer.cs
Demo_Source_Code/SecureShare/ShareFileSettingForm.cs
Demo_Source_Code/SecureShare/ShareFileSettingForm.resx
.vbs
Demo_Source_Code/SecureShare/SharedFileAccessLogForm.Designer.cs
Demo_Source_Code/SecureShare/SharedFileAccessLogForm.cs
Demo_Source_Code/SecureShare/SharedFileAccessLogForm.resx
.vbs
Demo_Source_Code/SecureShare/WebAPIService.cs
.js
Demo_Source_Code/SecureShare/app.config
.xml
Demo_Source_Code/SecureShare/app.manifest
Doc/License.rtf
.rtf
Doc/Manual.docx
.docx office2007
Doc/Manual.pdf
.pdf
- http://easefilter.com
- http://www.easefilter.com/Order.htm
- https://www.easefilter.com/programming.htm
Doc/Order Products.url
.url
Doc/easefilter_changeset.txt
EaseFltCSConsoleDemo.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:59:43:f8:20:80:05:60:63:3f:15:7b:a3:47:d0:7e:10:91:df:ba:f9:3c:0d:5d:e5:44:71:d1:56:f5:c6:32
Signer

Actual PE Digest

5c:59:43:f8:20:80:05:60:63:3f:15:7b:a3:47:d0:7e:10:91:df:ba:f9:3c:0d:5d:e5:44:71:d1:56:f5:c6:32

Digest Algorithm

sha256

PE Digest Matches

true

be:ce:e3:30:17:19:65:42:da:1a:26:46:16:0a:55:f1:73:f4:03:13
Signer

Actual PE Digest

be:ce:e3:30:17:19:65:42:da:1a:26:46:16:0a:55:f1:73:f4:03:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\EaseFltCSConsoleDemo\obj\Release\EaseFltCSConsoleDemo.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FileMonitor.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

88:8c:a6:30:b3:00:14:e6:e7:b3:9c:6c:5e:be:b5:96:5c:0e:34:b6:e2:b3:0a:9b:85:e2:1c:d1:fe:4f:cd:d9
Signer

Actual PE Digest

88:8c:a6:30:b3:00:14:e6:e7:b3:9c:6c:5e:be:b5:96:5c:0e:34:b6:e2:b3:0a:9b:85:e2:1c:d1:fe:4f:cd:d9

Digest Algorithm

sha256

PE Digest Matches

true

4f:87:06:4a:49:4e:e2:34:a4:35:6f:7e:e6:4b:48:16:46:ce:0c:60
Signer

Actual PE Digest

4f:87:06:4a:49:4e:e2:34:a4:35:6f:7e:e6:4b:48:16:46:ce:0c:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\FileMonitor\obj\Release\FileMonitor.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FileProtector.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:c0:07:2a:09:d5:31:c9:5c:f8:ca:53:e5:c1:da:9d:3b:6a:56:3f:07:a6:57:ca:4b:90:22:50:2a:0f:4c:b2
Signer

Actual PE Digest

6c:c0:07:2a:09:d5:31:c9:5c:f8:ca:53:e5:c1:da:9d:3b:6a:56:3f:07:a6:57:ca:4b:90:22:50:2a:0f:4c:b2

Digest Algorithm

sha256

PE Digest Matches

true

ca:84:f8:25:68:3c:6a:84:bd:a6:b0:36:a0:c5:ad:55:94:18:0f:18
Signer

Actual PE Digest

ca:84:f8:25:68:3c:6a:84:bd:a6:b0:36:a0:c5:ad:55:94:18:0f:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\FileProtector\obj\Release\FileProtector.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FilterControl.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ba:08:3c:e1:2e:92:85:9b:fb:70:d6:0f:17:8a:81:2b:79:14:ea:28:76:b0:0d:51:80:89:c2:a1:bc:25:c0:d7
Signer

Actual PE Digest

ba:08:3c:e1:2e:92:85:9b:fb:70:d6:0f:17:8a:81:2b:79:14:ea:28:76:b0:0d:51:80:89:c2:a1:bc:25:c0:d7

Digest Algorithm

sha256

PE Digest Matches

true

23:33:c8:8e:e6:38:d4:66:4e:03:1e:5d:b4:57:3f:ee:aa:41:f0:44
Signer

Actual PE Digest

23:33:c8:8e:e6:38:d4:66:4e:03:1e:5d:b4:57:3f:ee:aa:41:f0:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Development\Demo\FilterControl\obj\Release\FilterControl.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FolderLocker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:16:de:c7:b7:b9:bf:d6:2c:fb:3b:06:55:1c:4a:b1:0d:ec:e7:44:57:c3:5e:81:d5:54:e0:b0:5b:ad:cc:a6
Signer

Actual PE Digest

02:16:de:c7:b7:b9:bf:d6:2c:fb:3b:06:55:1c:4a:b1:0d:ec:e7:44:57:c3:5e:81:d5:54:e0:b0:5b:ad:cc:a6

Digest Algorithm

sha256

PE Digest Matches

true

3a:42:0c:5e:e1:a3:6e:90:e4:76:4f:68:03:07:f2:9d:72:87:a0:96
Signer

Actual PE Digest

3a:42:0c:5e:e1:a3:6e:90:e4:76:4f:68:03:07:f2:9d:72:87:a0:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\FileLocker\obj\Release\FolderLocker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ProcessMon.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:4b:94:77:6d:25:8c:74:6c:09:18:d5:72:24:94:5c:d8:b5:87:50:dd:67:7c:e7:dc:ee:b2:44:08:db:db:28
Signer

Actual PE Digest

30:4b:94:77:6d:25:8c:74:6c:09:18:d5:72:24:94:5c:d8:b5:87:50:dd:67:7c:e7:dc:ee:b2:44:08:db:db:28

Digest Algorithm

sha256

PE Digest Matches

true

0c:9a:ad:39:cc:87:e7:e4:e1:b2:fc:00:c3:3f:e9:30:86:6f:ee:7d
Signer

Actual PE Digest

0c:9a:ad:39:cc:87:e7:e4:e1:b2:fc:00:c3:3f:e9:30:86:6f:ee:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\ProcessMon\obj\Release\ProcessMon.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ReadMe.txt
RegMon.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

94:cd:75:6f:68:fc:22:be:71:b2:a8:1c:d8:99:42:9d:b7:7b:a4:fe:94:52:de:33:1d:df:29:45:ac:00:42:23
Signer

Actual PE Digest

94:cd:75:6f:68:fc:22:be:71:b2:a8:1c:d8:99:42:9d:b7:7b:a4:fe:94:52:de:33:1d:df:29:45:ac:00:42:23

Digest Algorithm

sha256

PE Digest Matches

true

66:29:6c:c1:1e:8b:a6:52:73:5c:76:18:1e:de:7d:ce:e8:79:ac:1a
Signer

Actual PE Digest

66:29:6c:c1:1e:8b:a6:52:73:5c:76:18:1e:de:7d:ce:e8:79:ac:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\RegMon\obj\Release\RegMon.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SecureSandbox.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

af:a9:d6:d6:dc:c0:a2:2d:8a:8f:4c:f1:e9:f5:8e:33:5c:8a:e7:dc:58:89:7b:55:19:7c:3d:81:f0:dc:34:96
Signer

Actual PE Digest

af:a9:d6:d6:dc:c0:a2:2d:8a:8f:4c:f1:e9:f5:8e:33:5c:8a:e7:dc:58:89:7b:55:19:7c:3d:81:f0:dc:34:96

Digest Algorithm

sha256

PE Digest Matches

true

00:70:23:0b:ea:2d:06:51:58:fb:34:86:81:60:e7:d4:8b:d9:5f:e4
Signer

Actual PE Digest

00:70:23:0b:ea:2d:06:51:58:fb:34:86:81:60:e7:d4:8b:d9:5f:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\SecureSandbox\obj\Release\SecureSandbox.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 469KB - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SecureShare.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-09-2019 00:00

Not After

02-11-2022 12:00

Subject

SERIALNUMBER=2864592,CN=EaseFilter Technologies Limited,O=EaseFilter Technologies Limited,L=Central,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ac:f2:bf:08:8a:71:79:3b:80:f5:8c:fe:45:db:b3:74:bb:89:21:90:19:f4:5a:43:d6:06:d3:d2:29:28:6e:10
Signer

Actual PE Digest

ac:f2:bf:08:8a:71:79:3b:80:f5:8c:fe:45:db:b3:74:bb:89:21:90:19:f4:5a:43:d6:06:d3:d2:29:28:6e:10

Digest Algorithm

sha256

PE Digest Matches

true

0a:9f:4d:1c:23:04:18:79:90:f0:f3:4b:88:73:5d:d2:c7:e5:56:7a
Signer

Actual PE Digest

0a:9f:4d:1c:23:04:18:79:90:f0:f3:4b:88:73:5d:d2:c7:e5:56:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Development\Demo\SecureShare\obj\Release\SecureShare.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe
.exe windows:4 windows x86 arch:x86

6e7f9a29f2c85394521a08b9f31f6275

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode

user32

wsprintfW
CharNextExA
SendMessageW
FindWindowExW
CharNextW
CharPrevW

kernel32

CreatePipe
DeleteFileW
lstrcmpiW
GetCommandLineW
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
MultiByteToWideChar
IsDBCSLeadByteEx
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
CreateProcessW
GetStartupInfoW
CreateFileMappingW
GetVersion
GetCurrentProcess
lstrcpynW
lstrlenW
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
GlobalFree
CreateFileW
CopyFileW
GetTempFileNameW
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e7f9a29f2c85394521a08b9f31f6275

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 1KB - Virtual size: 172KB

.ndata Size: - Virtual size: 72KB

.rsrc Size: 17KB - Virtual size: 16KB

4b45b7e00344a87332fbd12653854d1a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 19KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 648B

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1cCertificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1KB - Virtual size: 172KB

.ndata
Size: - Virtual size: 72KB

.rsrc
Size: 17KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 19KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 648B

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

51:be:83:fd:05:4f:a6:8c:dc:b7:1c:10:7e:6d:02:f2:47:0e:58:d4:3e:17:79:dd:14:07:3b:48:26:25:86:5d
Signer

78:7c:af:e5:b6:2e:fc:1a:00:cf:9c:05:e9:84:26:a1:80:d9:97:c6
Signer

.text
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 12B

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0f:31:2f:ad:09:74:c5:12:c3:d6:5c:09:bd:62:fb:1c
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0e:0a:2e:90:48:fa:06:fa:97:f5:26:31:d7:cd:2c:f1
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e8:c2:47:cc:f1:fc:53:62:e1:ef:16:9f:c9:91:b8:22:83:33:a9:62:a6:84:50:91:a2:23:ef:61:e4:0f:0f:e9
Signer

66:e0:9c:36:41:2e:27:43:56:65:bf:fb:5c:0b:8c:64:46:5c:bb:03
Signer

.text
Size: 140KB - Virtual size: 140KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 147KB - Virtual size: 146KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 8KB

.pdata
Size: 4KB - Virtual size: 4KB

PAGE
Size: 1KB - Virtual size: 1KB

INIT
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 1016B