net8[.]0-windows[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

net8.0-windows.zip
Size

73.9MB
MD5

73b62f795b94630a04631496885e004d
SHA1

33c66f21870b63e20b489f4fd0a47b11feceba72
SHA256

06d60487703367cb98fb087242c7764fa85f74d2f125aa936cde95534ac4eddb
SHA512

19473fb7d92504d08a33cdca9c07239442b74ccf37ae6ba55bbca198e7cc575d57387f5b773b1b5ab158ed67d03bb144df7b91a4a52cc7c630df6871153cb808
SSDEEP

1572864:mR4NxR4mu3LPvrxTO6V3rVJTMJ5BwtJkii48CwZIMqsyoKZulL0BD523eHN1Zhz:xK9bPzxPHTMJgt048CkgtT4V0FfHfZhz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/net8.0-windows/Resources/RisorseCreaISO/Risorse/OperaGXSetup.exe	upx

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/net8.0-windows/Resources/RisorseCreaISO/Risorse/7z.dll
unpack001/net8.0-windows/Resources/RisorseCreaISO/Risorse/7z.exe
unpack001/net8.0-windows/Resources/RisorseCreaISO/Risorse/OperaGXSetup.exe
unpack003/out.upx
unpack001/net8.0-windows/Resources/Rufus4Lite.exe
unpack001/net8.0-windows/WinHubX.dll
unpack001/net8.0-windows/WinHubX.exe

Files

net8.0-windows.zip
.zip
net8.0-windows/Images/Rufus-4Lite.png
.png
net8.0-windows/Images/extWIMToolkit.png
.png
net8.0-windows/Images/help.png
.png
net8.0-windows/Images/homeLogo.png
.png
net8.0-windows/Images/icoLogoWhite.ico
net8.0-windows/Images/nicksparrow.png
.png
net8.0-windows/Images/png365.png
.png
net8.0-windows/Images/pngArchitettura.png
.png
net8.0-windows/Images/pngAttivaOffice.png
.png
net8.0-windows/Images/pngAttivaWSA.png
.png
net8.0-windows/Images/pngAttivaWSL.png
.png
net8.0-windows/Images/pngAttivaWin.png
.png
net8.0-windows/Images/pngAvanti.png
.png
net8.0-windows/Images/pngBackArrow.png
.png
net8.0-windows/Images/pngCambioEdizione.png
.png
net8.0-windows/Images/pngClose.png
.png
net8.0-windows/Images/pngCoffee.png
.png
net8.0-windows/Images/pngCreaISO.png
.png
net8.0-windows/Images/pngDaRT.png
.png
net8.0-windows/Images/pngDebloat.png
.png
net8.0-windows/Images/pngDefenderWin.png
.png
net8.0-windows/Images/pngDisinstallaOffice.png
.png
net8.0-windows/Images/pngDomanda.png
.png
net8.0-windows/Images/pngEdge.png
.png
net8.0-windows/Images/pngHome.png
.png
net8.0-windows/Images/pngKasperskyLive.png
.png
net8.0-windows/Images/pngLogoWHX.png
.png
net8.0-windows/Images/pngMPM.png
.png
net8.0-windows/Images/pngMinimize.png
.png
net8.0-windows/Images/pngMonitoraggio.png
.png
net8.0-windows/Images/pngOffice.png
.png
net8.0-windows/Images/pngOfficeHome.png
.png
net8.0-windows/Images/pngOfficenuovo.png
.png
net8.0-windows/Images/pngOffline.png
.png
net8.0-windows/Images/pngOnline.png
.png
net8.0-windows/Images/pngPersonalizzaOffice.png
.png
net8.0-windows/Images/pngPersonalizzazione.png
.png
net8.0-windows/Images/pngPrivacy.png
.png
net8.0-windows/Images/pngRipristinaWindows.png
.png
net8.0-windows/Images/pngSettaggi.png
.png
net8.0-windows/Images/pngTelegram.png
.png
net8.0-windows/Images/pngTools.png
.png
net8.0-windows/Images/pngUpdateWin.png
.png
net8.0-windows/Images/pngUtility.png
.png
net8.0-windows/Images/pngWSA.png
.png
net8.0-windows/Images/pngWin.png
.png
net8.0-windows/Images/pngWin10.png
.png
net8.0-windows/Images/pngWin7.png
.png
net8.0-windows/Images/pngWin8dot1.png
.png
net8.0-windows/Images/pngWinLive.png
.png
net8.0-windows/Images/pngWinWhat.png
.png
net8.0-windows/Images/pngWindows.png
.png
net8.0-windows/Images/pngWindows11.png
.png
net8.0-windows/Images/pngWinhubxsystemmonitor.png
.png
net8.0-windows/Images/pngXtndLogo_WinHubX.png
.png
net8.0-windows/Images/pngbypass.png
.png
net8.0-windows/Images/pngprocessi.png
.png
net8.0-windows/Images/update.png
.png
net8.0-windows/Microsoft.ApplicationInsights.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:25:e8:db:42:83:99:fe:c8:cc:1a:de:6d:db:f1:37:8a:c6:80:ae:75:03:b5:02:1e:c8:d0:45:3f:29:84:7e
Signer

Actual PE Digest

ee:25:e8:db:42:83:99:fe:c8:cc:1a:de:6d:db:f1:37:8a:c6:80:ae:75:03:b5:02:1e:c8:d0:45:3f:29:84:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/obj/Release/Microsoft.ApplicationInsights/netstandard2.0/Microsoft.ApplicationInsights.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Microsoft.Win32.Registry.AccessControl.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:ca:6a:62:ef:fb:a4:09:65:00:a9:dc:bf:f0:81:a7:e3:c5:ae:11:52:a4:75:e5:e2:5f:e4:0c:d7:ad:db:57
Signer

Actual PE Digest

0a:ca:6a:62:ef:fb:a4:09:65:00:a9:dc:bf:f0:81:a7:e3:c5:ae:11:52:a4:75:e5:e2:5f:e4:0c:d7:ad:db:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/Release/net8.0/Microsoft.Win32.Registry.AccessControl.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/01/2021, 00:00

Not After

14/01/2046, 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/07/2021, 00:00

Not After

14/07/2031, 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13/08/2021, 00:00

Not After

29/10/2024, 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Signer

Actual PE Digest

12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 681KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/CheckHW.bat
.bat .vbs
net8.0-windows/Resources/DriverRST.zip
.zip
drivers/amd rst/NVMe_CC/rcbottom/rcbottom.cat
drivers/amd rst/NVMe_CC/rcbottom/rcbottom.inf
drivers/amd rst/NVMe_CC/rcbottom/rcbottom.sys
.sys windows:6 windows x64 arch:x64

4520d1114914143547e1eb10624e9b37

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01
Signer

Actual PE Digest

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01

Digest Algorithm

sha256

PE Digest Matches

true

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1
Signer

Actual PE Digest

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rcbottom\rcbottom\windows\driver\obj_fre_winv10.0_amd64\amd64\rcbottom.pdb

Imports

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlCompareMemory
KeInitializeSpinLock
ExGetFirmwareEnvironmentVariable
MmMapIoSpace
MmUnmapIoSpace
RtlInitUnicodeString
KeReleaseInStackQueuedSpinLock
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetAttachedDeviceReference
ObfDereferenceObject
KeBugCheckEx
RtlCopyUnicodeString
RtlUnicodeStringToInteger
RtlIntegerToUnicodeString
wcsncpy
wcsncmp
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
DbgPrintEx

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass

storport.sys

StorPortDebugPrint
StorPortInitialize

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/NVMe_CC/rccfg/rccfg.cat
drivers/amd rst/NVMe_CC/rccfg/rccfg.inf
drivers/amd rst/NVMe_CC/rccfg/rccfg.sys
.sys windows:6 windows x64 arch:x64

52bcb8c680de4d0ae1fce317d0de33bd

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22
Signer

Actual PE Digest

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22

Digest Algorithm

sha256

PE Digest Matches

true

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd
Signer

Actual PE Digest

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rccfg\windows\driver\obj_fre_winv10.0_amd64\amd64\rccfg.pdb

Imports

ntoskrnl.exe

RtlInitString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeSetPriorityThread
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePool
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateErrorLogEntry
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoGetAttachedDeviceReference
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoWriteErrorLogEntry
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfDereferenceObject
sprintf
_snwprintf
ExFreePoolWithTag
MmUnlockPages
IoAllocateIrp
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
KeBugCheckEx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 855B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/NVMe_CC/rcraid/rcraid.cat
drivers/amd rst/NVMe_CC/rcraid/rcraid.inf
drivers/amd rst/NVMe_CC/rcraid/rcraid.sys
.sys windows:6 windows x64 arch:x64

4c57bee85137d05b1171a3ab3b067b3e

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:eb:63:b1:f4:72:15:c5:62:5b:4a:4a:43:29:3d:ec:89:8d:65:cb:39:c3:5c:81:2c:c5:11:1f:05:1d:5d:97
Signer

Actual PE Digest

e5:eb:63:b1:f4:72:15:c5:62:5b:4a:4a:43:29:3d:ec:89:8d:65:cb:39:c3:5c:81:2c:c5:11:1f:05:1d:5d:97

Digest Algorithm

sha256

PE Digest Matches

true

70:76:5e:72:84:a0:18:d0:e4:ba:f3:98:74:69:b6:42:b5:49:1e:6d
Signer

Actual PE Digest

70:76:5e:72:84:a0:18:d0:e4:ba:f3:98:74:69:b6:42:b5:49:1e:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rcraid\windows\driver\obj_fre_winv10.0_amd64\amd64\rcraid.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoReuseIrp
DbgBreakPoint
strncmp
strstr
_snprintf
strcmp
strncpy
RtlInitUnicodeString
KeInitializeEvent
KeInitializeDpc
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeSaveExtendedProcessorState
KeRestoreExtendedProcessorState
PsCreateSystemThread
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
KeBugCheckEx

hal

KeQueryPerformanceCounter

storport.sys

StorPortInitialize
StorPortNotification
StorPortLogError
StorPortExtendedFunction
StorPortAllocateRegistryBuffer
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortGetScatterGatherList
StorPortStallExecution

Sections

.text
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/NVMe_DID/rcbottom/rcbottom.cat
drivers/amd rst/NVMe_DID/rcbottom/rcbottom.inf
drivers/amd rst/NVMe_DID/rcbottom/rcbottom.sys
.sys windows:6 windows x64 arch:x64

4520d1114914143547e1eb10624e9b37

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01
Signer

Actual PE Digest

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01

Digest Algorithm

sha256

PE Digest Matches

true

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1
Signer

Actual PE Digest

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rcbottom\rcbottom\windows\driver\obj_fre_winv10.0_amd64\amd64\rcbottom.pdb

Imports

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlCompareMemory
KeInitializeSpinLock
ExGetFirmwareEnvironmentVariable
MmMapIoSpace
MmUnmapIoSpace
RtlInitUnicodeString
KeReleaseInStackQueuedSpinLock
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetAttachedDeviceReference
ObfDereferenceObject
KeBugCheckEx
RtlCopyUnicodeString
RtlUnicodeStringToInteger
RtlIntegerToUnicodeString
wcsncpy
wcsncmp
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
DbgPrintEx

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass

storport.sys

StorPortDebugPrint
StorPortInitialize

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/NVMe_DID/rccfg/rccfg.cat
drivers/amd rst/NVMe_DID/rccfg/rccfg.inf
drivers/amd rst/NVMe_DID/rccfg/rccfg.sys
.sys windows:6 windows x64 arch:x64

52bcb8c680de4d0ae1fce317d0de33bd

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22
Signer

Actual PE Digest

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22

Digest Algorithm

sha256

PE Digest Matches

true

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd
Signer

Actual PE Digest

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rccfg\windows\driver\obj_fre_winv10.0_amd64\amd64\rccfg.pdb

Imports

ntoskrnl.exe

RtlInitString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeSetPriorityThread
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePool
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateErrorLogEntry
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoGetAttachedDeviceReference
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoWriteErrorLogEntry
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfDereferenceObject
sprintf
_snwprintf
ExFreePoolWithTag
MmUnlockPages
IoAllocateIrp
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
KeBugCheckEx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 855B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/NVMe_DID/rcraid/rcraid.cat
drivers/amd rst/NVMe_DID/rcraid/rcraid.inf
drivers/amd rst/NVMe_DID/rcraid/rcraid.sys
.sys windows:6 windows x64 arch:x64

4c57bee85137d05b1171a3ab3b067b3e

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:eb:63:b1:f4:72:15:c5:62:5b:4a:4a:43:29:3d:ec:89:8d:65:cb:39:c3:5c:81:2c:c5:11:1f:05:1d:5d:97
Signer

Actual PE Digest

e5:eb:63:b1:f4:72:15:c5:62:5b:4a:4a:43:29:3d:ec:89:8d:65:cb:39:c3:5c:81:2c:c5:11:1f:05:1d:5d:97

Digest Algorithm

sha256

PE Digest Matches

true

70:76:5e:72:84:a0:18:d0:e4:ba:f3:98:74:69:b6:42:b5:49:1e:6d
Signer

Actual PE Digest

70:76:5e:72:84:a0:18:d0:e4:ba:f3:98:74:69:b6:42:b5:49:1e:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rcraid\windows\driver\obj_fre_winv10.0_amd64\amd64\rcraid.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoReuseIrp
DbgBreakPoint
strncmp
strstr
_snprintf
strcmp
strncpy
RtlInitUnicodeString
KeInitializeEvent
KeInitializeDpc
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeSaveExtendedProcessorState
KeRestoreExtendedProcessorState
PsCreateSystemThread
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
KeBugCheckEx

hal

KeQueryPerformanceCounter

storport.sys

StorPortInitialize
StorPortNotification
StorPortLogError
StorPortExtendedFunction
StorPortAllocateRegistryBuffer
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortGetScatterGatherList
StorPortStallExecution

Sections

.text
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/RAID_SATA/rcbottom/rcbottom.cat
drivers/amd rst/RAID_SATA/rcbottom/rcbottom.inf
drivers/amd rst/RAID_SATA/rcbottom/rcbottom.sys
.sys windows:6 windows x64 arch:x64

4520d1114914143547e1eb10624e9b37

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01
Signer

Actual PE Digest

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01

Digest Algorithm

sha256

PE Digest Matches

true

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1
Signer

Actual PE Digest

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rcbottom\rcbottom\windows\driver\obj_fre_winv10.0_amd64\amd64\rcbottom.pdb

Imports

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlCompareMemory
KeInitializeSpinLock
ExGetFirmwareEnvironmentVariable
MmMapIoSpace
MmUnmapIoSpace
RtlInitUnicodeString
KeReleaseInStackQueuedSpinLock
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetAttachedDeviceReference
ObfDereferenceObject
KeBugCheckEx
RtlCopyUnicodeString
RtlUnicodeStringToInteger
RtlIntegerToUnicodeString
wcsncpy
wcsncmp
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
DbgPrintEx

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass

storport.sys

StorPortDebugPrint
StorPortInitialize

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/RAID_SATA/rccfg/rccfg.cat
drivers/amd rst/RAID_SATA/rccfg/rccfg.inf
drivers/amd rst/RAID_SATA/rccfg/rccfg.sys
.sys windows:6 windows x64 arch:x64

52bcb8c680de4d0ae1fce317d0de33bd

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22
Signer

Actual PE Digest

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22

Digest Algorithm

sha256

PE Digest Matches

true

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd
Signer

Actual PE Digest

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rccfg\windows\driver\obj_fre_winv10.0_amd64\amd64\rccfg.pdb

Imports

ntoskrnl.exe

RtlInitString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeSetPriorityThread
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePool
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateErrorLogEntry
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoGetAttachedDeviceReference
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoWriteErrorLogEntry
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfDereferenceObject
sprintf
_snwprintf
ExFreePoolWithTag
MmUnlockPages
IoAllocateIrp
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
KeBugCheckEx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 855B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/amd rst/RAID_SATA/rcraid/rcraid.cat
drivers/amd rst/RAID_SATA/rcraid/rcraid.inf
drivers/amd rst/RAID_SATA/rcraid/rcraid.sys
.sys windows:6 windows x64 arch:x64

4c57bee85137d05b1171a3ab3b067b3e

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:eb:63:b1:f4:72:15:c5:62:5b:4a:4a:43:29:3d:ec:89:8d:65:cb:39:c3:5c:81:2c:c5:11:1f:05:1d:5d:97
Signer

Actual PE Digest

e5:eb:63:b1:f4:72:15:c5:62:5b:4a:4a:43:29:3d:ec:89:8d:65:cb:39:c3:5c:81:2c:c5:11:1f:05:1d:5d:97

Digest Algorithm

sha256

PE Digest Matches

true

70:76:5e:72:84:a0:18:d0:e4:ba:f3:98:74:69:b6:42:b5:49:1e:6d
Signer

Actual PE Digest

70:76:5e:72:84:a0:18:d0:e4:ba:f3:98:74:69:b6:42:b5:49:1e:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00296\fulcrum\rc\platforms\rcraid\windows\driver\obj_fre_winv10.0_amd64\amd64\rcraid.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoReuseIrp
DbgBreakPoint
strncmp
strstr
_snprintf
strcmp
strncpy
RtlInitUnicodeString
KeInitializeEvent
KeInitializeDpc
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeSaveExtendedProcessorState
KeRestoreExtendedProcessorState
PsCreateSystemThread
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
KeBugCheckEx

hal

KeQueryPerformanceCounter

storport.sys

StorPortInitialize
StorPortNotification
StorPortLogError
StorPortExtendedFunction
StorPortAllocateRegistryBuffer
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortGetScatterGatherList
StorPortStallExecution

Sections

.text
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/AHCI/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3
Signer

Actual PE Digest

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3

Digest Algorithm

sha256

PE Digest Matches

true

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3
Signer

Actual PE Digest

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/AHCI/RstMwService.exe
.exe windows:6 windows x64 arch:x64

c47de4d1dec059904db6bfa6b015b932

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78
Signer

Actual PE Digest

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78

Digest Algorithm

sha256

PE Digest Matches

true

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78
Signer

Actual PE Digest

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
CreateEventA
FormatMessageA
CreateFileA
WriteFile
InitializeSRWLock
TryAcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThread
GetExitCodeThread
WaitForSingleObjectEx
LocalAlloc
GetCurrentProcessId
FileTimeToSystemTime
GetSystemTime
GetSystemTimeAsFileTime
GetModuleHandleA
FormatMessageW
SystemTimeToFileTime
GetTimeFormatEx
GetDateFormatEx
InitializeCriticalSectionAndSpinCount
Sleep
VerSetConditionMask
VerifyVersionInfoA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
lstrlenA
GetDiskFreeSpaceExA
QueryPerformanceCounter
CreateMutexA
HeapReAlloc
HeapAlloc
ReleaseMutex
HeapDestroy
DecodePointer
WTSGetActiveConsoleSessionId
InitializeSListHead
SleepConditionVariableSRW
OpenProcess
GetPackageId
GetPackagePath
WakeAllConditionVariable
K32GetModuleBaseNameW
K32GetModuleFileNameExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EncodePointer
CreateFileW
SetLastError
DeviceIoControl
ReadFile
RtlUnwind
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
SetWaitableTimer
CreateWaitableTimerA
RtlPcToFileHeader
RtlUnwindEx
WriteConsoleW
GetFinalPathNameByHandleW
OpenFileById
GetProcAddress
GetModuleHandleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindNextFileW
GetModuleHandleExW
GetModuleFileNameW
ReadConsoleW
FindClose
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
FindFirstFileExW
OpenEventA
OpenMutexA
GetCurrentProcess
InitializeConditionVariable
WakeConditionVariable
CreateSemaphoreA
SleepConditionVariableCS
InitOnceExecuteOnce
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetCPInfo
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetTimeZoneInformation
CreateMutexW
WaitForMultipleObjects
LCMapStringEx
CompareStringEx
LocalFree
GetCommandLineA
InitializeCriticalSection
GetCommandLineW
GetLastError
CreateEventW
ResetEvent
CreateThread
CloseHandle
GetTickCount
GetFirmwareEnvironmentVariableW
GetStartupInfoW
GetFileType
GetStdHandle
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
SetEvent
WaitForSingleObject
DeleteFileW
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitThread
FreeLibraryAndExitThread
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW

advapi32

RegOpenKeyExW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
ControlService
EnumDependentServicesW
StartServiceW
DeregisterEventSource
RegisterEventSourceW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ReportEventW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
InitiateSystemShutdownA
RegSetKeyValueW
RegCreateKeyExW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
SetEntriesInAclW
RevertToSelf
ImpersonateLoggedOnUser
RegQueryValueExW
RegDeleteTreeW
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

RpcBindingVectorFree
RpcStringFreeA
UuidToStringA
NdrClientCall3
NdrServerCallAll
I_RpcGetCurrentCallHandle
I_RpcBindingInqLocalClientPID
NdrServerCall2
RpcServerInqBindings
RpcServerListen
RpcRevertToSelfEx
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpRegisterW
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpUnregister
RpcImpersonateClient
RpcRevertToSelf

userenv

UnloadUserProfile

ole32

CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoUninitialize
StringFromGUID2
CoInitializeEx

api-ms-win-core-path-l1-1-0

PathCchAppend

wintrust

WinVerifyTrust

user32

GetSystemMetrics

setupapi

CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeA
CM_Reenumerate_DevNode
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_ID_ListW

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_PropertyW
CM_Get_DevNode_PropertyW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

api-ms-win-devices-swdevice-l1-1-0

SwDeviceCreate
SwDeviceClose

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??0scoped_c_thread_locale@details@utility@@QEAA@XZ
??0value@json@web@@QEAA@$$QEAV012@@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@H@Z
??0value@json@web@@QEAA@I@Z
??0value@json@web@@QEAA@N@Z
??0value@json@web@@QEAA@PEB_W@Z
??0value@json@web@@QEAA@PEB_W_N@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QEAA@XZ
??0value@json@web@@QEAA@_J@Z
??0value@json@web@@QEAA@_K@Z
??0value@json@web@@QEAA@_N@Z
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??1scoped_c_thread_locale@details@utility@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z
??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z
??8value@json@web@@QEBA_NAEBV012@@Z
??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@_K@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?array@value@json@web@@SA?AV123@_K@Z
?as_array@value@json@web@@QEAAAEAVarray@23@XZ
?as_array@value@json@web@@QEBAAEBVarray@23@XZ
?as_bool@value@json@web@@QEBA_NXZ
?as_double@value@json@web@@QEBANXZ
?as_integer@value@json@web@@QEBAHXZ
?as_number@value@json@web@@QEBAAEBVnumber@23@XZ
?as_object@value@json@web@@QEAAAEAVobject@23@XZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEAAAEAV123@_K@Z
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
?boolean@value@json@web@@SA?AV123@_N@Z
?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QEAAX_K@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getErrorTypeSummary@CConsolidatedError@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?is_double@value@json@web@@QEBA_NXZ
?is_int32@number@json@web@@QEBA_NXZ
?is_int64@number@json@web@@QEBA_NXZ
?is_integer@value@json@web@@QEBA_NXZ
?is_uint32@number@json@web@@QEBA_NXZ
?keep_object_element_order@json@web@@YAX_N@Z
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z
?platform_category@details@utility@@YAAEBVerror_category@std@@XZ
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z
?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?windows_category@details@utility@@YAAEBVerror_category@std@@XZ
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiEventClose
IsiEventSetUpForAllWithHandle
IsiEventWaitWithHandle
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsRTD3HotEnabled
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetPhyHandles
IsiGetPhyInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiROHISetState
IsiRaidLevelModify
IsiReadPatrolSetState
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiStorageSwDeviceEnumerate
IsiToggleCoalescerPolicy
IsiUpdatePmInterfaceFields
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeConvertIrrtToRaid1
IsiVolumeConvertRaid1ToIrrt
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeIrrtCreate
IsiVolumeIrrtMountPartner
IsiVolumeIrrtSetAutomaticSync
IsiVolumeIrrtSetManualSync
IsiVolumeIrrtSwapDisks
IsiVolumeIrrtSync
IsiVolumeIrrtUnMountPartner
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/AHCI/iaAHCIC.cat
drivers/intel 10th and 11th Gen Platforms/AHCI/iaAHCIC.inf
drivers/intel 10th and 11th Gen Platforms/AHCI/iaStorAC.sys
.sys windows:10 windows x64 arch:x64

296eb31bab91116f2084fcb8487b4b7f

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc
Signer

Actual PE Digest

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc

Digest Algorithm

sha256

PE Digest Matches

true

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc
Signer

Actual PE Digest

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorA\x64\Release\iaStorAC.pdb

Imports

storport.sys

StorPortExtendedFunction
StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortNotification
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

ntoskrnl.exe

KeBugCheckEx
KeQueryActiveProcessorCount
sscanf_s
IoRegisterBootDriverReinitialization
KeDeregisterBugCheckReasonCallback
KeQueryGroupAffinity
IoSetDevicePropertyData
KeRegisterBugCheckReasonCallback
MmIsAddressValid
RtlGetVersion
IoGetDevicePropertyData
ZwSetValueKey
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
wcsnlen
MmGetPhysicalAddress
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLock
_snwprintf_s
KeQueryDpcWatchdogInformation
strtok_s
strncmp
_purecall
KeGetCurrentIrql
KeSetEvent
__chkstk
KeInitializeEvent
KfRaiseIrql
KeWaitForSingleObject
strstr
atol
IoAllocateWorkItem
IoFreeWorkItem
strncpy
PsSetCreateProcessNotifyRoutineEx
sprintf_s
_itoa_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
RtlTimeToTimeFields
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
RtlCompareMemory
KeLowerIrql
KeDelayExecutionThread
strcmp
_snprintf
ZwOpenKey
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
sprintf
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
EtwUnregister
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
strnlen
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId
IoGetIoPriorityHint

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/HsaComponent/iaStorHsaComponent.cat
drivers/intel 10th and 11th Gen Platforms/HsaComponent/iaStorHsaComponent.inf
drivers/intel 10th and 11th Gen Platforms/HsaExtension/iaStorHsa_Ext.cat
drivers/intel 10th and 11th Gen Platforms/HsaExtension/iaStorHsa_Ext.inf
drivers/intel 10th and 11th Gen Platforms/PinningComponent/OptaneShellExt.dll
.dll windows:4 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:ab:cc:1b:dd:00:67:9c:5c:4c:fc:df:86:10:07:12:47:18:df:d5:55:c8:ab:aa:e5:92:6c:61:17:7b:64:3b
Signer

Actual PE Digest

56:ab:cc:1b:dd:00:67:9c:5c:4c:fc:df:86:10:07:12:47:18:df:d5:55:c8:ab:aa:e5:92:6c:61:17:7b:64:3b

Digest Algorithm

sha256

PE Digest Matches

true

56:ab:cc:1b:dd:00:67:9c:5c:4c:fc:df:86:10:07:12:47:18:df:d5:55:c8:ab:aa:e5:92:6c:61:17:7b:64:3b
Signer

Actual PE Digest

56:ab:cc:1b:dd:00:67:9c:5c:4c:fc:df:86:10:07:12:47:18:df:d5:55:c8:ab:aa:e5:92:6c:61:17:7b:64:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\SES_UI\OptaneShellExt\source\OptaneShellExt\obj\x64\Release\OptaneShellExt\OptaneShellExt.pdb

Sections

.text
Size: 627KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/PinningComponent/PinningServiceApi.dll
.dll windows:4 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:32:19:96:58:88:ea:c4:e4:0e:c0:cc:ea:db:c1:ad:f4:2f:4f:8c:19:4c:75:1a:6a:92:ca:e5:cb:73:ef:5e
Signer

Actual PE Digest

0e:32:19:96:58:88:ea:c4:e4:0e:c0:cc:ea:db:c1:ad:f4:2f:4f:8c:19:4c:75:1a:6a:92:ca:e5:cb:73:ef:5e

Digest Algorithm

sha256

PE Digest Matches

true

0e:32:19:96:58:88:ea:c4:e4:0e:c0:cc:ea:db:c1:ad:f4:2f:4f:8c:19:4c:75:1a:6a:92:ca:e5:cb:73:ef:5e
Signer

Actual PE Digest

0e:32:19:96:58:88:ea:c4:e4:0e:c0:cc:ea:db:c1:ad:f4:2f:4f:8c:19:4c:75:1a:6a:92:ca:e5:cb:73:ef:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_NGSA\Implementation\source\PinningServiceApi\obj\x64\Release\PinningServiceApi.pdb

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/PinningComponent/SharpShell.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c
Signer

Actual PE Digest

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c

Digest Algorithm

sha256

PE Digest Matches

true

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c
Signer

Actual PE Digest

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\tmp\RST_pinning\Sharpshell_master_kw_test\SharpShell\SharpShell\obj\Release\SharpShell.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/PinningComponent/SharpShellLicense.txt
drivers/intel 10th and 11th Gen Platforms/PinningComponent/iaStorAfsServiceApi.dll
.dll windows:6 windows x64 arch:x64

b9f1d793fdda64c20457ac6a554af67c

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:f2:2b:1d:e0:d6:90:d3:76:d0:7a:bf:32:04:4c:50:72:0d:05:80:63:fa:7d:ce:33:d3:e6:31:7a:e9:59:3b
Signer

Actual PE Digest

9c:f2:2b:1d:e0:d6:90:d3:76:d0:7a:bf:32:04:4c:50:72:0d:05:80:63:fa:7d:ce:33:d3:e6:31:7a:e9:59:3b

Digest Algorithm

sha256

PE Digest Matches

true

9c:f2:2b:1d:e0:d6:90:d3:76:d0:7a:bf:32:04:4c:50:72:0d:05:80:63:fa:7d:ce:33:d3:e6:31:7a:e9:59:3b
Signer

Actual PE Digest

9c:f2:2b:1d:e0:d6:90:d3:76:d0:7a:bf:32:04:4c:50:72:0d:05:80:63:fa:7d:ce:33:d3:e6:31:7a:e9:59:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\OptaneApi\x64\Release\iaStorAfsServiceApi.pdb

Imports

advapi32

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

kernel32

LeaveCriticalSection
WriteConsoleW
CreateFileW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
LocalAlloc
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetCurrentThreadId
HeapAlloc
HeapFree
ExitProcess
EnterCriticalSection
GetProcAddress
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
GetProcessHeap
WideCharToMultiByte
HeapSize
HeapReAlloc
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetFilePointerEx
GetModuleHandleW
GetConsoleMode
GetConsoleOutputCP
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
WriteFile

rpcrt4

Ndr64AsyncClientCall
NdrClientCall3
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW

Exports

Exports

OptaneGetFileCacheStatus
OptaneGetPinStatusFiles
OptaneGetPinnedApplications
OptaneGetPinnedFilesDirectories
OptaneGetPinningApiVersion
OptaneGetPinningStatus
OptaneHardPinFilesDirectories
OptaneHardUnpinFilesDirectories
OptaneIsServiceRunning
OptanePinApplication
OptaneRegisterListener
OptaneResolvePaths
OptaneTriggerMigration
OptaneUnpinApplication
OptaneUnregisterListener

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/PinningComponent/iaStorPinningComponent.cat
drivers/intel 10th and 11th Gen Platforms/PinningComponent/iaStorPinningComponent.inf
drivers/intel 10th and 11th Gen Platforms/RAID/HfcDisableService.exe
.exe windows:6 windows x64 arch:x64

d5a3baa3ab16406523aaf8f81a17879f

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:68:6e:bb:8d:69:2f:42:d5:8a:eb:6a:aa:db:a4:37:72:ca:ab:6b:a8:e3:9b:33:7f:e5:80:03:33:d8:f8:80
Signer

Actual PE Digest

25:68:6e:bb:8d:69:2f:42:d5:8a:eb:6a:aa:db:a4:37:72:ca:ab:6b:a8:e3:9b:33:7f:e5:80:03:33:d8:f8:80

Digest Algorithm

sha256

PE Digest Matches

true

25:68:6e:bb:8d:69:2f:42:d5:8a:eb:6a:aa:db:a4:37:72:ca:ab:6b:a8:e3:9b:33:7f:e5:80:03:33:d8:f8:80
Signer

Actual PE Digest

25:68:6e:bb:8d:69:2f:42:d5:8a:eb:6a:aa:db:a4:37:72:ca:ab:6b:a8:e3:9b:33:7f:e5:80:03:33:d8:f8:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Middleware\HfcDisableService\HfcDisableService\output\Release\x64\HfcDisableService.pdb

Imports

setupapi

CM_Reenumerate_DevNode
CM_Locate_DevNodeA
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW

advapi32

RegDeleteTreeW
ControlService
EnumDependentServicesW
StartServiceW
ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
OpenServiceW
ChangeServiceConfigW
QueryServiceStatusEx
RegSetKeyValueW
LookupPrivilegeValueA
OpenSCManagerW
CloseServiceHandle
RegDeleteValueA
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
AdjustTokenPrivileges
InitiateSystemShutdownW
OpenProcessToken
LookupPrivilegeValueW

kernel32

GlobalAddAtomW
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
HeapSize
FileTimeToSystemTime
FormatMessageW
LocalFree
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
CreateFileA
CreateFileW
SetLastError
DeviceIoControl
WriteFile
ReadFile
lstrlenA
CreateMutexA
ReleaseMutex
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
CreateProcessW
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFirmwareEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
VerSetConditionMask
VerifyVersionInfoA
GetExitCodeProcess
CloseHandle
GetLastError
CreateEventW
GetDiskFreeSpaceExA
SetWaitableTimer
CreateWaitableTimerA
__C_specific_handler
GetCommandLineW
GetCommandLineA
ExitProcess
CreateEventA
OpenEventA
OpenMutexA
SetFilePointerEx
GetFileSizeEx
CreateSemaphoreA
ResetEvent
CreateThread
SetEvent
GetStdHandle
GetDateFormatW
GetFinalPathNameByHandleW
OpenFileById
GetProcAddress
GetModuleHandleW
FindNextFileW
GetModuleHandleExW
GetModuleFileNameW
GetOEMCP
GetACP
FindClose
IsValidCodePage
GetSystemTimeAsFileTime
EnumSystemLocalesW
FlsFree
FlsSetValue
Sleep
WaitForSingleObject
WriteConsoleW
HeapFree
HeapAlloc
GetFileType
GetTimeZoneInformation
GetTickCount
FreeLibrary
LoadLibraryExW
FlsGetValue
HeapReAlloc
DeleteFileW
LocalAlloc
FlsAlloc
InterlockedPushEntrySList
GetEnvironmentStringsW
RaiseException
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlPcToFileHeader
CompareStringW
RtlUnwindEx
GetTimeFormatW
RtlUnwind
K32GetModuleBaseNameW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetStringTypeW
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetLocaleInfoEx
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW

user32

GetSystemMetrics

api-ms-win-devices-swdevice-l1-1-0

SwDeviceClose
SwDeviceCreate

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

ole32

CoUninitialize
StringFromGUID2
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoCreateInstance

rpcrt4

RpcBindingFromStringBindingW
RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall3

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW
CM_Get_Device_Interface_PropertyW

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getErrorTypeSummary@CConsolidatedError@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiRaidLevelModify
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiToggleCoalescerPolicy
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/Optane.dll
.dll windows:6 windows x64 arch:x64

f5541305f8f72207e31e757d73f65cc4

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c
Signer

Actual PE Digest

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c

Digest Algorithm

sha256

PE Digest Matches

true

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c
Signer

Actual PE Digest

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\OptaneApi\x64\ReleaseOEM\Optane.pdb

Imports

advapi32

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

kernel32

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
__C_specific_handler
WriteConsoleW
CreateFileW
DeleteCriticalSection
LocalAlloc
LocalFree
CloseHandle
LeaveCriticalSection
GetConsoleMode
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedFlushSList
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP

rpcrt4

NdrClientCall3
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW

Exports

Exports

OptanePinOemApplication

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/OptaneEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72
Signer

Actual PE Digest

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72

Digest Algorithm

sha256

PE Digest Matches

true

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72
Signer

Actual PE Digest

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\Output\Driver\x64\Release\OptaneEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3
Signer

Actual PE Digest

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3

Digest Algorithm

sha256

PE Digest Matches

true

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3
Signer

Actual PE Digest

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/RstMwService.exe
.exe windows:6 windows x64 arch:x64

c47de4d1dec059904db6bfa6b015b932

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78
Signer

Actual PE Digest

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78

Digest Algorithm

sha256

PE Digest Matches

true

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78
Signer

Actual PE Digest

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
CreateEventA
FormatMessageA
CreateFileA
WriteFile
InitializeSRWLock
TryAcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThread
GetExitCodeThread
WaitForSingleObjectEx
LocalAlloc
GetCurrentProcessId
FileTimeToSystemTime
GetSystemTime
GetSystemTimeAsFileTime
GetModuleHandleA
FormatMessageW
SystemTimeToFileTime
GetTimeFormatEx
GetDateFormatEx
InitializeCriticalSectionAndSpinCount
Sleep
VerSetConditionMask
VerifyVersionInfoA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
lstrlenA
GetDiskFreeSpaceExA
QueryPerformanceCounter
CreateMutexA
HeapReAlloc
HeapAlloc
ReleaseMutex
HeapDestroy
DecodePointer
WTSGetActiveConsoleSessionId
InitializeSListHead
SleepConditionVariableSRW
OpenProcess
GetPackageId
GetPackagePath
WakeAllConditionVariable
K32GetModuleBaseNameW
K32GetModuleFileNameExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EncodePointer
CreateFileW
SetLastError
DeviceIoControl
ReadFile
RtlUnwind
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
SetWaitableTimer
CreateWaitableTimerA
RtlPcToFileHeader
RtlUnwindEx
WriteConsoleW
GetFinalPathNameByHandleW
OpenFileById
GetProcAddress
GetModuleHandleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindNextFileW
GetModuleHandleExW
GetModuleFileNameW
ReadConsoleW
FindClose
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
FindFirstFileExW
OpenEventA
OpenMutexA
GetCurrentProcess
InitializeConditionVariable
WakeConditionVariable
CreateSemaphoreA
SleepConditionVariableCS
InitOnceExecuteOnce
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetCPInfo
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetTimeZoneInformation
CreateMutexW
WaitForMultipleObjects
LCMapStringEx
CompareStringEx
LocalFree
GetCommandLineA
InitializeCriticalSection
GetCommandLineW
GetLastError
CreateEventW
ResetEvent
CreateThread
CloseHandle
GetTickCount
GetFirmwareEnvironmentVariableW
GetStartupInfoW
GetFileType
GetStdHandle
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
SetEvent
WaitForSingleObject
DeleteFileW
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitThread
FreeLibraryAndExitThread
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW

advapi32

RegOpenKeyExW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
ControlService
EnumDependentServicesW
StartServiceW
DeregisterEventSource
RegisterEventSourceW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ReportEventW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
InitiateSystemShutdownA
RegSetKeyValueW
RegCreateKeyExW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
SetEntriesInAclW
RevertToSelf
ImpersonateLoggedOnUser
RegQueryValueExW
RegDeleteTreeW
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

RpcBindingVectorFree
RpcStringFreeA
UuidToStringA
NdrClientCall3
NdrServerCallAll
I_RpcGetCurrentCallHandle
I_RpcBindingInqLocalClientPID
NdrServerCall2
RpcServerInqBindings
RpcServerListen
RpcRevertToSelfEx
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpRegisterW
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpUnregister
RpcImpersonateClient
RpcRevertToSelf

userenv

UnloadUserProfile

ole32

CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoUninitialize
StringFromGUID2
CoInitializeEx

api-ms-win-core-path-l1-1-0

PathCchAppend

wintrust

WinVerifyTrust

user32

GetSystemMetrics

setupapi

CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeA
CM_Reenumerate_DevNode
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_ID_ListW

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_PropertyW
CM_Get_DevNode_PropertyW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

api-ms-win-devices-swdevice-l1-1-0

SwDeviceCreate
SwDeviceClose

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??0scoped_c_thread_locale@details@utility@@QEAA@XZ
??0value@json@web@@QEAA@$$QEAV012@@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@H@Z
??0value@json@web@@QEAA@I@Z
??0value@json@web@@QEAA@N@Z
??0value@json@web@@QEAA@PEB_W@Z
??0value@json@web@@QEAA@PEB_W_N@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QEAA@XZ
??0value@json@web@@QEAA@_J@Z
??0value@json@web@@QEAA@_K@Z
??0value@json@web@@QEAA@_N@Z
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??1scoped_c_thread_locale@details@utility@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z
??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z
??8value@json@web@@QEBA_NAEBV012@@Z
??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@_K@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?array@value@json@web@@SA?AV123@_K@Z
?as_array@value@json@web@@QEAAAEAVarray@23@XZ
?as_array@value@json@web@@QEBAAEBVarray@23@XZ
?as_bool@value@json@web@@QEBA_NXZ
?as_double@value@json@web@@QEBANXZ
?as_integer@value@json@web@@QEBAHXZ
?as_number@value@json@web@@QEBAAEBVnumber@23@XZ
?as_object@value@json@web@@QEAAAEAVobject@23@XZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEAAAEAV123@_K@Z
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
?boolean@value@json@web@@SA?AV123@_N@Z
?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QEAAX_K@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getErrorTypeSummary@CConsolidatedError@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?is_double@value@json@web@@QEBA_NXZ
?is_int32@number@json@web@@QEBA_NXZ
?is_int64@number@json@web@@QEBA_NXZ
?is_integer@value@json@web@@QEBA_NXZ
?is_uint32@number@json@web@@QEBA_NXZ
?keep_object_element_order@json@web@@YAX_N@Z
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z
?platform_category@details@utility@@YAAEBVerror_category@std@@XZ
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z
?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?windows_category@details@utility@@YAAEBVerror_category@std@@XZ
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiEventClose
IsiEventSetUpForAllWithHandle
IsiEventWaitWithHandle
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsRTD3HotEnabled
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetPhyHandles
IsiGetPhyInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiROHISetState
IsiRaidLevelModify
IsiReadPatrolSetState
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiStorageSwDeviceEnumerate
IsiToggleCoalescerPolicy
IsiUpdatePmInterfaceFields
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeConvertIrrtToRaid1
IsiVolumeConvertRaid1ToIrrt
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeIrrtCreate
IsiVolumeIrrtMountPartner
IsiVolumeIrrtSetAutomaticSync
IsiVolumeIrrtSetManualSync
IsiVolumeIrrtSwapDisks
IsiVolumeIrrtSync
IsiVolumeIrrtUnMountPartner
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/iaStorAC.cat
drivers/intel 10th and 11th Gen Platforms/RAID/iaStorAC.inf
drivers/intel 10th and 11th Gen Platforms/RAID/iaStorAC.sys
.sys windows:10 windows x64 arch:x64

296eb31bab91116f2084fcb8487b4b7f

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc
Signer

Actual PE Digest

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc

Digest Algorithm

sha256

PE Digest Matches

true

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc
Signer

Actual PE Digest

5d:6b:97:a0:ce:5f:3b:c2:af:f2:9a:e6:ec:ae:43:54:70:6f:c8:77:33:2f:22:1d:b8:3a:d8:5b:2a:8c:4b:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorA\x64\Release\iaStorAC.pdb

Imports

storport.sys

StorPortExtendedFunction
StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortNotification
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

ntoskrnl.exe

KeBugCheckEx
KeQueryActiveProcessorCount
sscanf_s
IoRegisterBootDriverReinitialization
KeDeregisterBugCheckReasonCallback
KeQueryGroupAffinity
IoSetDevicePropertyData
KeRegisterBugCheckReasonCallback
MmIsAddressValid
RtlGetVersion
IoGetDevicePropertyData
ZwSetValueKey
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
wcsnlen
MmGetPhysicalAddress
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLock
_snwprintf_s
KeQueryDpcWatchdogInformation
strtok_s
strncmp
_purecall
KeGetCurrentIrql
KeSetEvent
__chkstk
KeInitializeEvent
KfRaiseIrql
KeWaitForSingleObject
strstr
atol
IoAllocateWorkItem
IoFreeWorkItem
strncpy
PsSetCreateProcessNotifyRoutineEx
sprintf_s
_itoa_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
RtlTimeToTimeFields
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
RtlCompareMemory
KeLowerIrql
KeDelayExecutionThread
strcmp
_snprintf
ZwOpenKey
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
sprintf
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
EtwUnregister
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
strnlen
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId
IoGetIoPriorityHint

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/iaStorAfs.sys
.sys windows:10 windows x64 arch:x64

47b8b8f0c984d69066d8368cbe3c5bd8

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f
Signer

Actual PE Digest

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f

Digest Algorithm

sha256

PE Digest Matches

true

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f
Signer

Actual PE Digest

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfs.pdb

Imports

ntoskrnl.exe

ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlIsNtDdiVersionAvailable
IoWMIRegistrationControl
__C_specific_handler
_local_unwind
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
KeWaitForSingleObject
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeBugCheckEx
KeInitializeEvent
KeClearEvent
KeSetEvent
RtlInitUnicodeString
IoThreadToProcess
PsGetProcessId
PsSetCreateProcessNotifyRoutineEx
IoGetTopLevelIrp
KeAreApcsDisabled
KeGetCurrentIrql
ExAllocatePool2
ExFreePoolWithTag
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
strcpy_s
KeWaitForMultipleObjects
_purecall

fltmgr.sys

FltObjectDereference
FltGetVolumeFromName
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseClientPort
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetFileContext
FltSupportsFileContexts
FltReleaseContext
FltSetFileContext
FltAllocateContext
FltQueryInformationFile
FltSendMessage

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/iaStorAfsNative.exe
.sys windows:5 windows x64 arch:x64

4f22e599ba6ed8ce074e352a789948fe

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e
Signer

Actual PE Digest

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e

Digest Algorithm

sha256

PE Digest Matches

true

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e
Signer

Actual PE Digest

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsNative.pdb

Imports

ntdll

RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
NtDisplayString
NtQueryInformationFile
NtCreateFile
NtDeviceIoControlFile
NtWaitForSingleObject
NtFsControlFile
NtReadFile
RtlCreateHeap
RtlDestroyHeap
RtlAllocateHeap
RtlFreeHeap
NtClose
NtWriteFile
NtWaitForMultipleObjects
NtDelayExecution
RtlCreateUserThread
ZwTerminateThread
NtCancelIoFile
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtCreateEvent
NtSetEvent
NtClearEvent

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/RAID/iaStorAfsService.exe
.exe windows:6 windows x64 arch:x64

a8ac88dc7ae327720be4445394838726

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02
Signer

Actual PE Digest

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02

Digest Algorithm

sha256

PE Digest Matches

true

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02
Signer

Actual PE Digest

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

Imports

kernel32

FindNextFileNameW
LocalFree
GetCommandLineA
TlsSetValue
CreateEventW
ResetEvent
Sleep
WaitForMultipleObjects
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetModuleHandleW
GetProcAddress
CreateFileW
DeviceIoControl
GetCommandLineW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
FindFirstFileExW
OutputDebugStringW
QueryPerformanceCounter
ReadFile
WriteFile
DeleteFileW
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
GetTickCount64
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
GetSystemDirectoryW
FindFirstFileNameW
GetFinalPathNameByHandleW
OpenFileById
FindFirstFileW
FindNextFileW
GetCurrentProcess
SetPriorityClass
DeleteTimerQueueTimer
GetSystemPowerStatus
HeapFree
TryEnterCriticalSection
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSection
ExitProcess
TlsAlloc
TlsFree
HeapReAlloc
MoveFileW
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
DecodePointer
WaitForSingleObject
SetEvent
SetEnvironmentVariableW
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
TlsGetValue
CompareFileTime
ExpandEnvironmentStringsW
GetSystemTime
SystemTimeToFileTime
SuspendThread
ResumeThread
FindClose
lstrlenW
GetOverlappedResult
CancelIoEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetCurrentThreadId
HeapQueryInformation
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetStartupInfoW
RaiseException
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WideCharToMultiByte
SetConsoleCtrlHandler
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
SetStdHandle
ReadConsoleW
WriteConsoleW
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
EncodePointer
InterlockedFlushSList
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
FormatMessageA
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
SetFilePointer
FileTimeToLocalFileTime
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
UnmapViewOfFile
FileTimeToSystemTime
HeapValidate
GetTempPathA
FormatMessageW
LeaveCriticalSection
AreFileApisANSI
EnterCriticalSection
GetTickCount
MapViewOfFile
CreateFileMappingW
GetFileSize
LockFileEx
UnlockFile
HeapCompact
LoadLibraryW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTimeZoneInformation

advapi32

DeregisterEventSource
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
QueryServiceStatusEx
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
ControlService
DeleteService
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ChangeServiceConfig2W
OpenSCManagerW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseServiceHandle
SetEntriesInAclW
CreateServiceW
RegDeleteTreeW
RegCreateKeyExW

shlwapi

PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathIsRelativeW
PathFileExistsW
PathRemoveFileSpecW

rpcrt4

RpcServerUseProtseqEpW
RpcImpersonateClient
RpcRevertToSelf
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcEpRegisterW
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcEpUnregister
RpcServerTestCancel
RpcAsyncCompleteCall
RpcBindingVectorFree
RpcServerInqBindings
RpcServerUnregisterIf
RpcServerListen
RpcAsyncAbortCall
RpcServerRegisterIf3

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoSetProxyBlanket

oleaut32

VariantInit
VariantClear
SysAllocString
SetErrorInfo
VariantChangeType
GetErrorInfo
CreateErrorInfo
SysFreeString

fltlib

FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

user32

LoadStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 498KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/Optane.dll
.dll windows:6 windows x64 arch:x64

f5541305f8f72207e31e757d73f65cc4

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c
Signer

Actual PE Digest

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c

Digest Algorithm

sha256

PE Digest Matches

true

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c
Signer

Actual PE Digest

8c:55:35:c9:68:95:aa:d4:5a:c7:33:38:2f:25:73:d5:21:eb:cf:d2:06:87:fe:ae:9d:ec:c8:0f:f1:cc:eb:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\OptaneApi\x64\ReleaseOEM\Optane.pdb

Imports

advapi32

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

kernel32

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
__C_specific_handler
WriteConsoleW
CreateFileW
DeleteCriticalSection
LocalAlloc
LocalFree
CloseHandle
LeaveCriticalSection
GetConsoleMode
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedFlushSList
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP

rpcrt4

NdrClientCall3
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW

Exports

Exports

OptanePinOemApplication

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/OptaneEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72
Signer

Actual PE Digest

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72

Digest Algorithm

sha256

PE Digest Matches

true

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72
Signer

Actual PE Digest

fb:00:ad:ac:18:9d:7b:4f:c8:52:26:ba:74:15:a7:ee:7e:89:55:f5:cb:22:ab:c3:c1:c3:34:f9:6e:37:c6:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\Output\Driver\x64\Release\OptaneEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3
Signer

Actual PE Digest

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3

Digest Algorithm

sha256

PE Digest Matches

true

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3
Signer

Actual PE Digest

e5:5f:47:55:a2:dc:ab:79:0b:e8:63:4d:57:1c:0e:79:82:98:84:9f:7f:e2:d2:25:d9:3d:51:58:35:47:80:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\17493\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/RstMwService.exe
.exe windows:6 windows x64 arch:x64

c47de4d1dec059904db6bfa6b015b932

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78
Signer

Actual PE Digest

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78

Digest Algorithm

sha256

PE Digest Matches

true

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78
Signer

Actual PE Digest

46:e1:2f:bf:48:9a:94:ed:bc:8b:69:94:e4:c6:ff:a3:e4:6f:9f:16:e3:7d:ed:0d:23:80:ff:02:ad:da:86:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
CreateEventA
FormatMessageA
CreateFileA
WriteFile
InitializeSRWLock
TryAcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThread
GetExitCodeThread
WaitForSingleObjectEx
LocalAlloc
GetCurrentProcessId
FileTimeToSystemTime
GetSystemTime
GetSystemTimeAsFileTime
GetModuleHandleA
FormatMessageW
SystemTimeToFileTime
GetTimeFormatEx
GetDateFormatEx
InitializeCriticalSectionAndSpinCount
Sleep
VerSetConditionMask
VerifyVersionInfoA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
lstrlenA
GetDiskFreeSpaceExA
QueryPerformanceCounter
CreateMutexA
HeapReAlloc
HeapAlloc
ReleaseMutex
HeapDestroy
DecodePointer
WTSGetActiveConsoleSessionId
InitializeSListHead
SleepConditionVariableSRW
OpenProcess
GetPackageId
GetPackagePath
WakeAllConditionVariable
K32GetModuleBaseNameW
K32GetModuleFileNameExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EncodePointer
CreateFileW
SetLastError
DeviceIoControl
ReadFile
RtlUnwind
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
SetWaitableTimer
CreateWaitableTimerA
RtlPcToFileHeader
RtlUnwindEx
WriteConsoleW
GetFinalPathNameByHandleW
OpenFileById
GetProcAddress
GetModuleHandleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindNextFileW
GetModuleHandleExW
GetModuleFileNameW
ReadConsoleW
FindClose
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
FindFirstFileExW
OpenEventA
OpenMutexA
GetCurrentProcess
InitializeConditionVariable
WakeConditionVariable
CreateSemaphoreA
SleepConditionVariableCS
InitOnceExecuteOnce
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetCPInfo
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetTimeZoneInformation
CreateMutexW
WaitForMultipleObjects
LCMapStringEx
CompareStringEx
LocalFree
GetCommandLineA
InitializeCriticalSection
GetCommandLineW
GetLastError
CreateEventW
ResetEvent
CreateThread
CloseHandle
GetTickCount
GetFirmwareEnvironmentVariableW
GetStartupInfoW
GetFileType
GetStdHandle
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
SetEvent
WaitForSingleObject
DeleteFileW
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitThread
FreeLibraryAndExitThread
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW

advapi32

RegOpenKeyExW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
ControlService
EnumDependentServicesW
StartServiceW
DeregisterEventSource
RegisterEventSourceW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ReportEventW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
InitiateSystemShutdownA
RegSetKeyValueW
RegCreateKeyExW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
SetEntriesInAclW
RevertToSelf
ImpersonateLoggedOnUser
RegQueryValueExW
RegDeleteTreeW
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

RpcBindingVectorFree
RpcStringFreeA
UuidToStringA
NdrClientCall3
NdrServerCallAll
I_RpcGetCurrentCallHandle
I_RpcBindingInqLocalClientPID
NdrServerCall2
RpcServerInqBindings
RpcServerListen
RpcRevertToSelfEx
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpRegisterW
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpUnregister
RpcImpersonateClient
RpcRevertToSelf

userenv

UnloadUserProfile

ole32

CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoUninitialize
StringFromGUID2
CoInitializeEx

api-ms-win-core-path-l1-1-0

PathCchAppend

wintrust

WinVerifyTrust

user32

GetSystemMetrics

setupapi

CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeA
CM_Reenumerate_DevNode
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_ID_ListW

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_PropertyW
CM_Get_DevNode_PropertyW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

api-ms-win-devices-swdevice-l1-1-0

SwDeviceCreate
SwDeviceClose

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??0scoped_c_thread_locale@details@utility@@QEAA@XZ
??0value@json@web@@QEAA@$$QEAV012@@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@H@Z
??0value@json@web@@QEAA@I@Z
??0value@json@web@@QEAA@N@Z
??0value@json@web@@QEAA@PEB_W@Z
??0value@json@web@@QEAA@PEB_W_N@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QEAA@XZ
??0value@json@web@@QEAA@_J@Z
??0value@json@web@@QEAA@_K@Z
??0value@json@web@@QEAA@_N@Z
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??1scoped_c_thread_locale@details@utility@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z
??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z
??8value@json@web@@QEBA_NAEBV012@@Z
??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@_K@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?array@value@json@web@@SA?AV123@_K@Z
?as_array@value@json@web@@QEAAAEAVarray@23@XZ
?as_array@value@json@web@@QEBAAEBVarray@23@XZ
?as_bool@value@json@web@@QEBA_NXZ
?as_double@value@json@web@@QEBANXZ
?as_integer@value@json@web@@QEBAHXZ
?as_number@value@json@web@@QEBAAEBVnumber@23@XZ
?as_object@value@json@web@@QEAAAEAVobject@23@XZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEAAAEAV123@_K@Z
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
?boolean@value@json@web@@SA?AV123@_N@Z
?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QEAAX_K@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getErrorTypeSummary@CConsolidatedError@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?is_double@value@json@web@@QEBA_NXZ
?is_int32@number@json@web@@QEBA_NXZ
?is_int64@number@json@web@@QEBA_NXZ
?is_integer@value@json@web@@QEBA_NXZ
?is_uint32@number@json@web@@QEBA_NXZ
?keep_object_element_order@json@web@@YAX_N@Z
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z
?platform_category@details@utility@@YAAEBVerror_category@std@@XZ
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z
?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?windows_category@details@utility@@YAAEBVerror_category@std@@XZ
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiEventClose
IsiEventSetUpForAllWithHandle
IsiEventWaitWithHandle
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsRTD3HotEnabled
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetPhyHandles
IsiGetPhyInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiROHISetState
IsiRaidLevelModify
IsiReadPatrolSetState
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiStorageSwDeviceEnumerate
IsiToggleCoalescerPolicy
IsiUpdatePmInterfaceFields
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeConvertIrrtToRaid1
IsiVolumeConvertRaid1ToIrrt
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeIrrtCreate
IsiVolumeIrrtMountPartner
IsiVolumeIrrtSetAutomaticSync
IsiVolumeIrrtSetManualSync
IsiVolumeIrrtSwapDisks
IsiVolumeIrrtSync
IsiVolumeIrrtUnMountPartner
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/iaStorAfs.sys
.sys windows:10 windows x64 arch:x64

47b8b8f0c984d69066d8368cbe3c5bd8

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f
Signer

Actual PE Digest

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f

Digest Algorithm

sha256

PE Digest Matches

true

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f
Signer

Actual PE Digest

68:33:ad:f2:0c:21:40:2d:c1:c1:84:34:eb:a8:84:64:29:77:cc:b1:82:a9:14:ba:7b:c0:43:9e:5f:96:86:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfs.pdb

Imports

ntoskrnl.exe

ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlIsNtDdiVersionAvailable
IoWMIRegistrationControl
__C_specific_handler
_local_unwind
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
KeWaitForSingleObject
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeBugCheckEx
KeInitializeEvent
KeClearEvent
KeSetEvent
RtlInitUnicodeString
IoThreadToProcess
PsGetProcessId
PsSetCreateProcessNotifyRoutineEx
IoGetTopLevelIrp
KeAreApcsDisabled
KeGetCurrentIrql
ExAllocatePool2
ExFreePoolWithTag
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
strcpy_s
KeWaitForMultipleObjects
_purecall

fltmgr.sys

FltObjectDereference
FltGetVolumeFromName
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseClientPort
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetFileContext
FltSupportsFileContexts
FltReleaseContext
FltSetFileContext
FltAllocateContext
FltQueryInformationFile
FltSendMessage

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/iaStorAfsNative.exe
.sys windows:5 windows x64 arch:x64

4f22e599ba6ed8ce074e352a789948fe

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e
Signer

Actual PE Digest

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e

Digest Algorithm

sha256

PE Digest Matches

true

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e
Signer

Actual PE Digest

47:f7:5f:73:4f:eb:09:b7:68:89:ee:b5:95:95:1f:9b:20:13:78:28:06:e5:0f:91:42:55:14:de:62:d0:7f:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsNative.pdb

Imports

ntdll

RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
NtDisplayString
NtQueryInformationFile
NtCreateFile
NtDeviceIoControlFile
NtWaitForSingleObject
NtFsControlFile
NtReadFile
RtlCreateHeap
RtlDestroyHeap
RtlAllocateHeap
RtlFreeHeap
NtClose
NtWriteFile
NtWaitForMultipleObjects
NtDelayExecution
RtlCreateUserThread
ZwTerminateThread
NtCancelIoFile
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtCreateEvent
NtSetEvent
NtClearEvent

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/iaStorAfsService.exe
.exe windows:6 windows x64 arch:x64

a8ac88dc7ae327720be4445394838726

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02
Signer

Actual PE Digest

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02

Digest Algorithm

sha256

PE Digest Matches

true

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02
Signer

Actual PE Digest

d9:a5:7a:78:1d:5e:87:e7:0f:e6:c0:1d:2d:33:a0:b2:15:15:49:b9:94:29:72:35:a2:ca:a1:20:d1:91:c6:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

Imports

kernel32

FindNextFileNameW
LocalFree
GetCommandLineA
TlsSetValue
CreateEventW
ResetEvent
Sleep
WaitForMultipleObjects
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetModuleHandleW
GetProcAddress
CreateFileW
DeviceIoControl
GetCommandLineW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
FindFirstFileExW
OutputDebugStringW
QueryPerformanceCounter
ReadFile
WriteFile
DeleteFileW
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
GetTickCount64
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
GetSystemDirectoryW
FindFirstFileNameW
GetFinalPathNameByHandleW
OpenFileById
FindFirstFileW
FindNextFileW
GetCurrentProcess
SetPriorityClass
DeleteTimerQueueTimer
GetSystemPowerStatus
HeapFree
TryEnterCriticalSection
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSection
ExitProcess
TlsAlloc
TlsFree
HeapReAlloc
MoveFileW
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
DecodePointer
WaitForSingleObject
SetEvent
SetEnvironmentVariableW
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
TlsGetValue
CompareFileTime
ExpandEnvironmentStringsW
GetSystemTime
SystemTimeToFileTime
SuspendThread
ResumeThread
FindClose
lstrlenW
GetOverlappedResult
CancelIoEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetCurrentThreadId
HeapQueryInformation
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetStartupInfoW
RaiseException
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WideCharToMultiByte
SetConsoleCtrlHandler
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
SetStdHandle
ReadConsoleW
WriteConsoleW
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
EncodePointer
InterlockedFlushSList
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
FormatMessageA
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
SetFilePointer
FileTimeToLocalFileTime
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
UnmapViewOfFile
FileTimeToSystemTime
HeapValidate
GetTempPathA
FormatMessageW
LeaveCriticalSection
AreFileApisANSI
EnterCriticalSection
GetTickCount
MapViewOfFile
CreateFileMappingW
GetFileSize
LockFileEx
UnlockFile
HeapCompact
LoadLibraryW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTimeZoneInformation

advapi32

DeregisterEventSource
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
QueryServiceStatusEx
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
ControlService
DeleteService
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ChangeServiceConfig2W
OpenSCManagerW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseServiceHandle
SetEntriesInAclW
CreateServiceW
RegDeleteTreeW
RegCreateKeyExW

shlwapi

PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathIsRelativeW
PathFileExistsW
PathRemoveFileSpecW

rpcrt4

RpcServerUseProtseqEpW
RpcImpersonateClient
RpcRevertToSelf
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcEpRegisterW
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcEpUnregister
RpcServerTestCancel
RpcAsyncCompleteCall
RpcBindingVectorFree
RpcServerInqBindings
RpcServerUnregisterIf
RpcServerListen
RpcAsyncAbortCall
RpcServerRegisterIf3

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoSetProxyBlanket

oleaut32

VariantInit
VariantClear
SysAllocString
SetErrorInfo
VariantChangeType
GetErrorInfo
CreateErrorInfo
SysFreeString

fltlib

FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

user32

LoadStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 498KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 10th and 11th Gen Platforms/VMD/iaStorVD.cat
drivers/intel 10th and 11th Gen Platforms/VMD/iaStorVD.inf
drivers/intel 10th and 11th Gen Platforms/VMD/iaStorVD.sys
.sys windows:10 windows x64 arch:x64

296eb31bab91116f2084fcb8487b4b7f

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:59:be:8a:9d:d5:c1:08:19:24:4a:c0:96:ee:df:84:3e:42:e6:07:5c:fa:13:aa:3b:2f:f8:a9:00:80:b1:34
Signer

Actual PE Digest

2d:59:be:8a:9d:d5:c1:08:19:24:4a:c0:96:ee:df:84:3e:42:e6:07:5c:fa:13:aa:3b:2f:f8:a9:00:80:b1:34

Digest Algorithm

sha256

PE Digest Matches

true

2d:59:be:8a:9d:d5:c1:08:19:24:4a:c0:96:ee:df:84:3e:42:e6:07:5c:fa:13:aa:3b:2f:f8:a9:00:80:b1:34
Signer

Actual PE Digest

2d:59:be:8a:9d:d5:c1:08:19:24:4a:c0:96:ee:df:84:3e:42:e6:07:5c:fa:13:aa:3b:2f:f8:a9:00:80:b1:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\17493\SSE_Storage_Common\build\iaStorVD\x64\Release\iaStorVD.pdb

Imports

storport.sys

StorPortExtendedFunction
StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortNotification
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

ntoskrnl.exe

KeBugCheckEx
KeQueryActiveProcessorCount
sscanf_s
IoRegisterBootDriverReinitialization
KeDeregisterBugCheckReasonCallback
KeQueryGroupAffinity
IoSetDevicePropertyData
KeRegisterBugCheckReasonCallback
MmIsAddressValid
RtlGetVersion
IoGetDevicePropertyData
ZwSetValueKey
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
wcsnlen
MmGetPhysicalAddress
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLock
_snwprintf_s
KeQueryDpcWatchdogInformation
strtok_s
strncmp
_purecall
KeGetCurrentIrql
KeSetEvent
__chkstk
KeInitializeEvent
KfRaiseIrql
KeWaitForSingleObject
strstr
atol
IoAllocateWorkItem
IoFreeWorkItem
strncpy
PsSetCreateProcessNotifyRoutineEx
sprintf_s
_itoa_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
RtlTimeToTimeFields
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
RtlCompareMemory
KeLowerIrql
KeDelayExecutionThread
strcmp
_snprintf
ZwOpenKey
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
sprintf
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
EtwUnregister
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
strnlen
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId
IoGetIoPriorityHint

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 11th up to 13th Gen Platforms/HsaComponent/iaStorHsaComponent.cat
drivers/intel 11th up to 13th Gen Platforms/HsaComponent/iaStorHsaComponent.inf
drivers/intel 11th up to 13th Gen Platforms/HsaExtension/iaStorHsa_Ext.cat
drivers/intel 11th up to 13th Gen Platforms/HsaExtension/iaStorHsa_Ext.inf
drivers/intel 11th up to 13th Gen Platforms/VMD/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

0d:4e:38:71:e5:d0:b3:d9:85:94:5b:c6:24:f0:28:bc
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

81:5b:96:00:36:6e:37:da:37:0c:d1:54:6a:46:6d:79:2d:9d:0a:3f:e3:6b:d5:e7:64:a0:70:00:d9:57:d9:f5
Signer

Actual PE Digest

81:5b:96:00:36:6e:37:da:37:0c:d1:54:6a:46:6d:79:2d:9d:0a:3f:e3:6b:d5:e7:64:a0:70:00:d9:57:d9:f5

Digest Algorithm

sha256

PE Digest Matches

true

81:5b:96:00:36:6e:37:da:37:0c:d1:54:6a:46:6d:79:2d:9d:0a:3f:e3:6b:d5:e7:64:a0:70:00:d9:57:d9:f5
Signer

Actual PE Digest

81:5b:96:00:36:6e:37:da:37:0c:d1:54:6a:46:6d:79:2d:9d:0a:3f:e3:6b:d5:e7:64:a0:70:00:d9:57:d9:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba2\workspace\6834\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 11th up to 13th Gen Platforms/VMD/RstMwService.exe
.exe windows:6 windows x64 arch:x64

be28271308caeb236bd73d8acb278343

Code Sign

0d:4e:38:71:e5:d0:b3:d9:85:94:5b:c6:24:f0:28:bc
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:ce:c0:4c:f1:13:e5:0a:66:67:f2:2a:37:b9:8c:65:97:40:f6:1d:8b:4b:f1:86:00:2d:50:70:f0:70:f5:57
Signer

Actual PE Digest

4e:ce:c0:4c:f1:13:e5:0a:66:67:f2:2a:37:b9:8c:65:97:40:f6:1d:8b:4b:f1:86:00:2d:50:70:f0:70:f5:57

Digest Algorithm

sha256

PE Digest Matches

true

4e:ce:c0:4c:f1:13:e5:0a:66:67:f2:2a:37:b9:8c:65:97:40:f6:1d:8b:4b:f1:86:00:2d:50:70:f0:70:f5:57
Signer

Actual PE Digest

4e:ce:c0:4c:f1:13:e5:0a:66:67:f2:2a:37:b9:8c:65:97:40:f6:1d:8b:4b:f1:86:00:2d:50:70:f0:70:f5:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\6834\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
GetTickCount
HeapAlloc
FormatMessageW
InitializeCriticalSection
HeapDestroy
DecodePointer
LocalFree
CompareStringEx
CreateFileA
DeleteFileA
InitOnceExecuteOnce
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
ResetEvent
CreateEventA
GetSystemTimeAsFileTime
LocalAlloc
FormatMessageA
ReadFile
Sleep
lstrlenA
SleepConditionVariableCS
InitializeCriticalSectionAndSpinCount
VerSetConditionMask
VerifyVersionInfoA
GetCommandLineA
GetCommandLineW
FindClose
FindFirstFileExW
FindNextFileW
GetCurrentThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDiskFreeSpaceExA
WakeConditionVariable
CreateFileW
SetLastError
DeviceIoControl
InitializeConditionVariable
TryEnterCriticalSection
TryAcquireSRWLockExclusive
InitializeSRWLock
ReleaseMutex
GetModuleHandleA
GetVersion
OpenProcess
GetPackageId
GetPackagePath
GetExitCodeThread
K32GetModuleBaseNameW
K32GetModuleFileNameExW
WaitForSingleObjectEx
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
GetCurrentProcessId
QueryPerformanceCounter
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
SetWaitableTimer
CreateWaitableTimerA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EncodePointer
CreateMutexW
WaitForMultipleObjects
GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableW
OpenEventA
OpenMutexA
GetCurrentProcess
GetProcAddress
WaitForSingleObject
SetEvent
CloseHandle
GetLastError
CreateEventW
LCMapStringEx
WTSGetActiveConsoleSessionId
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
WriteConsoleW
GetModuleFileNameW
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
GetCurrentThreadId
ExitProcess
GetModuleHandleW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
RaiseException
GetStdHandle
GetFileType
GetStartupInfoW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetFileSizeEx
SetFilePointerEx
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP

advapi32

RegCreateKeyExW
ImpersonateLoggedOnUser
InitiateSystemShutdownA
RegSetKeyValueW
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
LookupPrivilegeValueA
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RevertToSelf
ReportEventW
RegDeleteTreeA
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
EnumDependentServicesA
DeleteService
ControlService
SetEntriesInAclW
RegisterEventSourceW
DeregisterEventSource
ChangeServiceConfigA
CloseServiceHandle
IsValidSid
InitializeSid
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority

ntdll

RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpRegisterW
RpcEpUnregister
I_RpcBindingInqLocalClientPID
I_RpcGetCurrentCallHandle
RpcImpersonateClient
RpcRevertToSelfEx
NdrServerCall2
RpcStringFreeA
UuidToStringA
NdrServerCallAll
RpcServerListen
RpcServerInqBindings
RpcBindingVectorFree
RpcRevertToSelf

userenv

UnloadUserProfile

setupapi

CM_Get_Device_Interface_ListW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_Interface_List_SizeW

api-ms-win-devices-swdevice-l1-1-0

SwDeviceCreate
SwDeviceClose

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

ole32

CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoCreateGuid
StringFromGUID2
CoReleaseMarshalData
CoUninitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoSetProxyBlanket

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_PropertyW
CM_Get_DevNode_PropertyW

user32

GetSystemMetrics

api-ms-win-core-path-l1-1-0

PathCchAppend

wintrust

WinVerifyTrust

oleaut32

SafeArrayLock
SafeArrayCreate
VariantClear
VariantInit
SysFreeString
SysAllocString
SafeArrayUnlock

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 11th up to 13th Gen Platforms/VMD/iaStorVD.cat
drivers/intel 11th up to 13th Gen Platforms/VMD/iaStorVD.inf
drivers/intel 11th up to 13th Gen Platforms/VMD/iaStorVD.sys
.sys windows:10 windows x64 arch:x64

04213e993af2eae5e4d6592ea1e8b7f4

Code Sign

0d:4e:38:71:e5:d0:b3:d9:85:94:5b:c6:24:f0:28:bc
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:39:06:1b:e8:ae:35:65:2f:ff:e3:71:08:3b:91:99:5f:1a:5e:28:ff:fa:a1:1d:14:79:c6:cf:a4:ee:fa:67
Signer

Actual PE Digest

68:39:06:1b:e8:ae:35:65:2f:ff:e3:71:08:3b:91:99:5f:1a:5e:28:ff:fa:a1:1d:14:79:c6:cf:a4:ee:fa:67

Digest Algorithm

sha256

PE Digest Matches

true

68:39:06:1b:e8:ae:35:65:2f:ff:e3:71:08:3b:91:99:5f:1a:5e:28:ff:fa:a1:1d:14:79:c6:cf:a4:ee:fa:67
Signer

Actual PE Digest

68:39:06:1b:e8:ae:35:65:2f:ff:e3:71:08:3b:91:99:5f:1a:5e:28:ff:fa:a1:1d:14:79:c6:cf:a4:ee:fa:67

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\6834\SSE_Storage_Common\build\iaStorVD\x64\Release\iaStorVD.pdb

Imports

storport.sys

StorPortExtendedFunction
StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortNotification
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

ntoskrnl.exe

strtok_s
ZwSetValueKey
KeQueryActiveProcessorCount
sscanf_s
IoRegisterBootDriverReinitialization
KeQueryGroupAffinity
IoSetDevicePropertyData
MmIsAddressValid
RtlIsServicePackVersionInstalled
KeDeregisterBugCheckReasonCallback
RtlGetVersion
IoGetDevicePropertyData
KeRegisterBugCheckReasonCallback
_snwprintf_s
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
MmGetPhysicalAddress
wcsnlen
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLock
strncmp
_purecall
KeGetCurrentIrql
KeSetEvent
KeLowerIrql
__chkstk
KfRaiseIrql
KeWaitForSingleObject
strstr
atol
IoAllocateWorkItem
IoFreeWorkItem
KeQueryDpcWatchdogInformation
sprintf_s
strnlen
_itoa_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
RtlTimeToTimeFields
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
RtlCompareMemory
KeInitializeEvent
strncpy
KeDelayExecutionThread
strcmp
ZwOpenKey
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
sprintf
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
EtwUnregister
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId
IoGetIoPriorityHint
PsSetCreateProcessNotifyRoutineEx

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 475KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/AHCI/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84
Signer

Actual PE Digest

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84

Digest Algorithm

sha256

PE Digest Matches

true

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84
Signer

Actual PE Digest

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba2\workspace\11566\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/AHCI/RstMwService.exe
.exe windows:6 windows x64 arch:x64

ff5cd5f1a8bf02f01560436a9ddc7ae0

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85
Signer

Actual PE Digest

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85

Digest Algorithm

sha256

PE Digest Matches

true

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85
Signer

Actual PE Digest

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

api-ms-win-core-synch-l1-1-0

CreateMutexA
ReleaseMutex
InitializeCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
CreateEventW
WaitForSingleObjectEx
CreateEventA
ResetEvent
SetWaitableTimer
InitializeCriticalSectionAndSpinCount
SetEvent
CreateMutexW
ReleaseSemaphore
DeleteCriticalSection
WaitForSingleObject
OpenEventA
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

ExitThread
GetCurrentThread
TlsAlloc
TlsSetValue
TlsFree
GetThreadPriority
SetThreadPriority
GetCurrentThreadId
SwitchToThread
CreateThread
GetStartupInfoW
ExitProcess
GetExitCodeThread
TerminateProcess
GetCurrentProcess
TlsGetValue
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

setupapi

CM_Get_Device_ID_List_SizeW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiRemoveDevice
CM_Get_DevNode_Status
CM_Get_Device_ID_ListW
CM_Reenumerate_DevNode
CM_Locate_DevNodeA
CM_Locate_DevNodeW

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegDeleteTreeW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
ControlService
EnumDependentServicesW
StartServiceW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
InitiateSystemShutdownA
RegSetKeyValueW
RegCreateKeyExW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
IsValidSid
InitializeSid
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation

ole32

CoGetInterfaceAndReleaseStream
CoCreateGuid
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoReleaseMarshalData
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

rpcrt4

RpcServerListen
RpcServerInqBindings
NdrClientCall3
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcImpersonateClient
RpcRevertToSelfEx
I_RpcGetCurrentCallHandle
NdrServerCall2
RpcRaiseException
I_RpcGetBuffer
NdrComplexStructMarshall
NdrCorrelationInitialize
NdrCorrelationPass
NdrCorrelationFree
NdrComplexStructBufferSize
RpcStringFreeA
UuidToStringA
NdrComplexStructFree
NdrConvert
NdrServerInitializeNew
RpcServerUseProtseqEpW
RpcBindingVectorFree
RpcRevertToSelf
I_RpcBindingInqLocalClientPID
RpcStringFreeW
RpcStringBindingComposeW
RpcEpUnregister
RpcBindingFromStringBindingW
RpcEpRegisterW
RpcMgmtStopServerListening

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapFree
HeapSize
GetProcessHeap
HeapReAlloc
HeapAlloc

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetVersionExW
GetLogicalProcessorInformation

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
FreeLibraryAndExitThread
GetModuleHandleW
GetModuleHandleExW
GetModuleHandleA
GetProcAddress
LoadLibraryExW

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetOEMCP
EnumSystemLocalesW
GetUserDefaultLCID
GetLocaleInfoW
GetCPInfo
GetACP
LCMapStringW
FormatMessageW
IsValidLocale

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetThreadTimes
IsProcessorFeaturePresent

api-ms-win-appmodel-runtime-l1-1-0

GetPackageId
GetPackagePath

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW
K32GetModuleBaseNameW

wintrust

WinVerifyTrust

api-ms-win-core-file-l1-1-0

FindClose
SetFilePointerEx
DeleteFileW
FindNextFileW
CreateFileW
GetFinalPathNameByHandleW
FlushFileBuffers
GetFileType
FindFirstFileExW
CreateFileA
ReadFile
GetDiskFreeSpaceExA
WriteFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

api-ms-win-core-synch-ansi-l1-1-0

OpenMutexA
CreateSemaphoreA
CreateWaitableTimerA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentStringsW
SetStdHandle
GetStdHandle
GetCommandLineA
GetCommandLineW
SetEnvironmentVariableA

api-ms-win-core-file-ansi-l1-1-0

QueryDosDeviceA

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
QueryDepthSList
InterlockedPopEntrySList
InitializeSListHead
InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-console-l1-1-0

WriteConsoleW
ReadConsoleW
GetConsoleCP
GetConsoleMode

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??0scoped_c_thread_locale@details@utility@@QEAA@XZ
??0value@json@web@@QEAA@$$QEAV012@@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@H@Z
??0value@json@web@@QEAA@I@Z
??0value@json@web@@QEAA@N@Z
??0value@json@web@@QEAA@PEB_W@Z
??0value@json@web@@QEAA@PEB_W_N@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QEAA@XZ
??0value@json@web@@QEAA@_J@Z
??0value@json@web@@QEAA@_K@Z
??0value@json@web@@QEAA@_N@Z
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??1scoped_c_thread_locale@details@utility@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z
??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z
??8value@json@web@@QEBA_NAEBV012@@Z
??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@_K@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?array@value@json@web@@SA?AV123@_K@Z
?as_array@value@json@web@@QEAAAEAVarray@23@XZ
?as_array@value@json@web@@QEBAAEBVarray@23@XZ
?as_bool@value@json@web@@QEBA_NXZ
?as_double@value@json@web@@QEBANXZ
?as_integer@value@json@web@@QEBAHXZ
?as_number@value@json@web@@QEBAAEBVnumber@23@XZ
?as_object@value@json@web@@QEAAAEAVobject@23@XZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEAAAEAV123@_K@Z
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
?boolean@value@json@web@@SA?AV123@_N@Z
?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QEAAX_K@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?is_double@value@json@web@@QEBA_NXZ
?is_int32@number@json@web@@QEBA_NXZ
?is_int64@number@json@web@@QEBA_NXZ
?is_integer@value@json@web@@QEBA_NXZ
?is_uint32@number@json@web@@QEBA_NXZ
?keep_object_element_order@json@web@@YAX_N@Z
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z
?platform_category@details@utility@@YAAEBVerror_category@std@@XZ
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z
?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?windows_category@details@utility@@YAAEBVerror_category@std@@XZ
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskGetPartitionTableInfos
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiEventClose
IsiEventSetUpForAllWithHandle
IsiEventWaitWithHandle
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsRTD3HotEnabled
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetPhyHandles
IsiGetPhyInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiROHISetState
IsiRaidLevelModify
IsiReadPatrolSetState
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiToggleCoalescerPolicy
IsiUpdatePmInterfaceFields
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeConvertIrrtToRaid1
IsiVolumeConvertRaid1ToIrrt
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeIrrtCreate
IsiVolumeIrrtMountPartner
IsiVolumeIrrtSetAutomaticSync
IsiVolumeIrrtSetManualSync
IsiVolumeIrrtSwapDisks
IsiVolumeIrrtSync
IsiVolumeIrrtUnMountPartner
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 617KB - Virtual size: 617KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 617B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/AHCI/iaAHCIC.cat
drivers/intel 8th and 9th Gen Platforms/AHCI/iaAHCIC.inf
drivers/intel 8th and 9th Gen Platforms/AHCI/iaStorAC.sys
.sys windows:10 windows x64 arch:x64

81e86f998a488764dff6fae597ff56d2

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f
Signer

Actual PE Digest

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f

Digest Algorithm

sha256

PE Digest Matches

true

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f
Signer

Actual PE Digest

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Common\build\iaStorA\x64\Release\iaStorAC.pdb

Imports

storport.sys

StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortSetDeviceQueueDepth
StorPortExtendedFunction
StorPortGetScatterGatherList
StorPortNotification

ntoskrnl.exe

KeBugCheckEx
sprintf_s
KeQueryActiveProcessorCount
KeDeregisterBugCheckReasonCallback
KeRegisterBugCheckReasonCallback
sscanf_s
IoRegisterBootDriverReinitialization
KeQueryGroupAffinity
IoSetDevicePropertyData
MmIsAddressValid
RtlGetVersion
IoGetDevicePropertyData
atol
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
wcsnlen
MmGetPhysicalAddress
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryDpcWatchdogInformation
PsSetCreateProcessNotifyRoutineEx
_snwprintf_s
IoGetIoPriorityHint
strtok_s
strncmp
_purecall
__chkstk
KeLowerIrql
KeInitializeEvent
KfRaiseIrql
KeWaitForSingleObject
IoAllocateWorkItem
IoFreeWorkItem
strncpy
memcpy_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlCompareMemory
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
KeSetEvent
KeDelayExecutionThread
sprintf
_snprintf
strcmp
ZwOpenKey
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
strstr
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
ZwQueryValueKey
PoRegisterPowerSettingCallback
PoUnregisterPowerSettingCallback
EtwUnregister
EtwWrite
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
strnlen
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/HsaComponent/iaStorHsaComponent.cat
drivers/intel 8th and 9th Gen Platforms/HsaComponent/iaStorHsaComponent.inf
drivers/intel 8th and 9th Gen Platforms/HsaExtension/iaStorHsa_Ext.cat
drivers/intel 8th and 9th Gen Platforms/HsaExtension/iaStorHsa_Ext.inf
drivers/intel 8th and 9th Gen Platforms/PinningComponent/OptaneShellExt.dll
.dll windows:4 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:ae:0e:4d:6d:dc:e1:97:9a:7d:75:42:df:05:db:da:88:4c:af:3b:8a:16:f1:03:b5:36:83:31:f4:bb:fb:87
Signer

Actual PE Digest

78:ae:0e:4d:6d:dc:e1:97:9a:7d:75:42:df:05:db:da:88:4c:af:3b:8a:16:f1:03:b5:36:83:31:f4:bb:fb:87

Digest Algorithm

sha256

PE Digest Matches

true

78:ae:0e:4d:6d:dc:e1:97:9a:7d:75:42:df:05:db:da:88:4c:af:3b:8a:16:f1:03:b5:36:83:31:f4:bb:fb:87
Signer

Actual PE Digest

78:ae:0e:4d:6d:dc:e1:97:9a:7d:75:42:df:05:db:da:88:4c:af:3b:8a:16:f1:03:b5:36:83:31:f4:bb:fb:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\11566\SES_UI\OptaneShellExt\source\OptaneShellExt\obj\x64\Release\OptaneShellExt\OptaneShellExt.pdb

Sections

.text
Size: 627KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/PinningComponent/PinningServiceApi.dll
.dll windows:4 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:a1:91:dc:45:60:f6:32:90:e1:80:31:9c:9a:e7:52:5b:86:ac:b9:5a:11:84:12:a4:17:f2:71:05:7b:73:79
Signer

Actual PE Digest

e8:a1:91:dc:45:60:f6:32:90:e1:80:31:9c:9a:e7:52:5b:86:ac:b9:5a:11:84:12:a4:17:f2:71:05:7b:73:79

Digest Algorithm

sha256

PE Digest Matches

true

e8:a1:91:dc:45:60:f6:32:90:e1:80:31:9c:9a:e7:52:5b:86:ac:b9:5a:11:84:12:a4:17:f2:71:05:7b:73:79
Signer

Actual PE Digest

e8:a1:91:dc:45:60:f6:32:90:e1:80:31:9c:9a:e7:52:5b:86:ac:b9:5a:11:84:12:a4:17:f2:71:05:7b:73:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\11566\SSE_Storage_NGSA\Implementation\source\PinningServiceApi\obj\x64\Release\PinningServiceApi.pdb

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/PinningComponent/SharpShell.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c
Signer

Actual PE Digest

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c

Digest Algorithm

sha256

PE Digest Matches

true

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c
Signer

Actual PE Digest

4f:85:1a:19:b9:28:02:9a:88:53:af:5e:0f:77:cb:4d:3e:7f:39:b3:52:06:9b:d7:6c:3b:00:5f:e6:2b:2d:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\tmp\RST_pinning\Sharpshell_master_kw_test\SharpShell\SharpShell\obj\Release\SharpShell.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/PinningComponent/SharpShellLicense.txt
drivers/intel 8th and 9th Gen Platforms/PinningComponent/iaStorAfsServiceApi.dll
.dll windows:6 windows x64 arch:x64

a121ebfba30ac53f1a7b600558e70d74

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:4d:7c:4a:54:ad:46:4f:c6:e1:6b:b6:fd:b6:76:88:9d:c2:3f:b2:bc:fd:6c:99:e1:7d:10:26:77:ae:eb:99
Signer

Actual PE Digest

24:4d:7c:4a:54:ad:46:4f:c6:e1:6b:b6:fd:b6:76:88:9d:c2:3f:b2:bc:fd:6c:99:e1:7d:10:26:77:ae:eb:99

Digest Algorithm

sha256

PE Digest Matches

true

24:4d:7c:4a:54:ad:46:4f:c6:e1:6b:b6:fd:b6:76:88:9d:c2:3f:b2:bc:fd:6c:99:e1:7d:10:26:77:ae:eb:99
Signer

Actual PE Digest

24:4d:7c:4a:54:ad:46:4f:c6:e1:6b:b6:fd:b6:76:88:9d:c2:3f:b2:bc:fd:6c:99:e1:7d:10:26:77:ae:eb:99

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\11566\SSE_Storage_Common\build\OptaneApi\x64\Release\iaStorAfsServiceApi.pdb

Imports

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
EnterCriticalSection
ResetEvent

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
Ndr64AsyncClientCall
NdrClientCall3
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlUnwindEx
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TlsAlloc
TlsGetValue
GetStartupInfoW
CreateThread
TerminateProcess
GetCurrentProcess
ExitProcess
TlsSetValue
TlsFree
ExitThread
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-heap-l1-1-0

HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage

api-ms-win-core-file-l1-1-0

FindFirstFileExA
FlushFileBuffers
WriteFile
FindNextFileA
GetFileType
SetFilePointerEx
CreateFileW
FindClose

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle
GetCommandLineA
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleCP
WriteConsoleW

Exports

Exports

OptaneGetFileCacheStatus
OptaneGetPinStatusFiles
OptaneGetPinnedApplications
OptaneGetPinnedFilesDirectories
OptaneGetPinningApiVersion
OptaneGetPinningStatus
OptaneHardPinFilesDirectories
OptaneHardUnpinFilesDirectories
OptaneIsServiceRunning
OptanePinApplication
OptaneRegisterListener
OptaneResolvePaths
OptaneTriggerMigration
OptaneUnpinApplication
OptaneUnregisterListener

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/PinningComponent/iaStorPinningComponent.cat
drivers/intel 8th and 9th Gen Platforms/PinningComponent/iaStorPinningComponent.inf
drivers/intel 8th and 9th Gen Platforms/RAID/HfcDisableService.exe
.exe windows:6 windows x64 arch:x64

1cd6b398a9aaa43e13b0b9091e8872ee

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:54:02:d3:b4:ed:3f:d4:b0:26:de:0c:6b:d8:67:79:7d:23:af:fa:29:19:23:34:52:79:29:e3:8d:ad:fa:08
Signer

Actual PE Digest

6b:54:02:d3:b4:ed:3f:d4:b0:26:de:0c:6b:d8:67:79:7d:23:af:fa:29:19:23:34:52:79:29:e3:8d:ad:fa:08

Digest Algorithm

sha256

PE Digest Matches

true

6b:54:02:d3:b4:ed:3f:d4:b0:26:de:0c:6b:d8:67:79:7d:23:af:fa:29:19:23:34:52:79:29:e3:8d:ad:fa:08
Signer

Actual PE Digest

6b:54:02:d3:b4:ed:3f:d4:b0:26:de:0c:6b:d8:67:79:7d:23:af:fa:29:19:23:34:52:79:29:e3:8d:ad:fa:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Middleware\HfcDisableService\HfcDisableService\output\Release\x64\HfcDisableService.pdb

Imports

setupapi

CM_Get_DevNode_Status
SetupDiRemoveDevice
CM_Reenumerate_DevNode
CM_Locate_DevNodeA
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
CM_Locate_DevNodeW

api-ms-win-service-management-l1-1-0

OpenServiceW
StartServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceStatusEx

api-ms-win-core-synch-l1-1-0

ResetEvent
InitializeCriticalSection
DeleteCriticalSection
SetEvent
EnterCriticalSection
TryEnterCriticalSection
CreateEventW
LeaveCriticalSection
WaitForSingleObject
OpenEventA
WaitForSingleObjectEx
CreateMutexA
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
CreateEventA
ReleaseSemaphore
ReleaseMutex

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetStartupInfoW
TlsAlloc
GetExitCodeProcess
TlsGetValue
GetCurrentThread
TlsSetValue
CreateThread
CreateProcessW
TlsFree
GetCurrentProcess
OpenProcessToken
ExitProcess
SetThreadPriority
GetThreadPriority
TerminateProcess
GetCurrentThreadId
SwitchToThread

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-service-winsvc-l1-1-0

ControlService
RegisterServiceCtrlHandlerW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueA
RegCreateKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegDeleteValueW
RegCloseKey
RegDeleteTreeW
RegOpenKeyExA

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-core-atoms-l1-1-0

GlobalAddAtomW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-localization-l1-2-0

IsValidLocale
IsValidCodePage
FormatMessageW
GetACP
EnumSystemLocalesW
GetCPInfo
GetUserDefaultLCID
LCMapStringW
GetLocaleInfoW
GetOEMCP

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-file-l1-1-0

FindNextFileW
GetFileType
GetDiskFreeSpaceExA
ReadFile
FlushFileBuffers
SetFilePointerEx
DeleteFileW
FindClose
FindFirstFileExW
CreateFileW
WriteFile
GetFinalPathNameByHandleW
CreateFileA

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-com-l1-1-0

CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoUninitialize
StringFromGUID2

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA
CreateSemaphoreA
OpenMutexA

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall3

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

oleaut32

SysAllocString
VariantInit
SysFreeString
VariantClear

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetModuleHandleA
LoadLibraryExW
FreeLibrary
FreeLibraryAndExitThread

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCommandLineW
GetEnvironmentStringsW
SetStdHandle
GetStdHandle
FreeEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetLogicalProcessorInformation
GetSystemTimeAsFileTime

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

advapi32

ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
InitiateSystemShutdownW

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
InterlockedPopEntrySList
InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx
CreateTimerQueue

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualFree

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l1-1-0

HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

ReadConsoleW
WriteConsoleW
GetConsoleCP
GetConsoleMode

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskGetPartitionTableInfos
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiRaidLevelModify
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiToggleCoalescerPolicy
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 510KB - Virtual size: 509KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 617B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/Optane.dll
.dll windows:6 windows x64 arch:x64

aaef0fd3e4b1e92ee7f62a9b7008830b

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:42:d4:b0:db:13:2c:45:84:86:3a:0d:1e:f3:ca:e4:68:50:48:52:27:ec:cf:cf:ad:a5:46:c8:21:db:2d:88
Signer

Actual PE Digest

91:42:d4:b0:db:13:2c:45:84:86:3a:0d:1e:f3:ca:e4:68:50:48:52:27:ec:cf:cf:ad:a5:46:c8:21:db:2d:88

Digest Algorithm

sha256

PE Digest Matches

true

91:42:d4:b0:db:13:2c:45:84:86:3a:0d:1e:f3:ca:e4:68:50:48:52:27:ec:cf:cf:ad:a5:46:c8:21:db:2d:88
Signer

Actual PE Digest

91:42:d4:b0:db:13:2c:45:84:86:3a:0d:1e:f3:ca:e4:68:50:48:52:27:ec:cf:cf:ad:a5:46:c8:21:db:2d:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Common\build\OptaneApi\x64\ReleaseOEM\Optane.pdb

Imports

rpcrt4

NdrClientCall3
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW

kernel32

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
LocalFree
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DeleteCriticalSection
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
WriteConsoleW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile

advapi32

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

Exports

Exports

OptanePinOemApplication

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/OptaneEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:f8:39:98:b8:48:64:db:1a:e2:9e:e5:4e:20:ce:54:03:65:33:35:f0:3e:df:53:93:51:3a:d0:55:01:9e:9f
Signer

Actual PE Digest

b3:f8:39:98:b8:48:64:db:1a:e2:9e:e5:4e:20:ce:54:03:65:33:35:f0:3e:df:53:93:51:3a:d0:55:01:9e:9f

Digest Algorithm

sha256

PE Digest Matches

true

b3:f8:39:98:b8:48:64:db:1a:e2:9e:e5:4e:20:ce:54:03:65:33:35:f0:3e:df:53:93:51:3a:d0:55:01:9e:9f
Signer

Actual PE Digest

b3:f8:39:98:b8:48:64:db:1a:e2:9e:e5:4e:20:ce:54:03:65:33:35:f0:3e:df:53:93:51:3a:d0:55:01:9e:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba2\workspace\11566\Output\Driver\x64\Release\OptaneEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84
Signer

Actual PE Digest

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84

Digest Algorithm

sha256

PE Digest Matches

true

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84
Signer

Actual PE Digest

fc:24:20:14:39:fc:96:b2:70:72:20:bf:60:4a:ca:5a:0e:f8:a9:ea:0e:f5:be:9c:2e:9c:db:89:a4:d9:86:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba2\workspace\11566\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/RstMwService.exe
.exe windows:6 windows x64 arch:x64

ff5cd5f1a8bf02f01560436a9ddc7ae0

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85
Signer

Actual PE Digest

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85

Digest Algorithm

sha256

PE Digest Matches

true

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85
Signer

Actual PE Digest

11:8d:d1:8a:f5:c5:0e:75:33:90:77:72:67:be:cf:e8:2d:67:d4:9c:59:96:20:4b:56:ac:1b:5a:ae:60:bd:85

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

api-ms-win-core-synch-l1-1-0

CreateMutexA
ReleaseMutex
InitializeCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
CreateEventW
WaitForSingleObjectEx
CreateEventA
ResetEvent
SetWaitableTimer
InitializeCriticalSectionAndSpinCount
SetEvent
CreateMutexW
ReleaseSemaphore
DeleteCriticalSection
WaitForSingleObject
OpenEventA
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

ExitThread
GetCurrentThread
TlsAlloc
TlsSetValue
TlsFree
GetThreadPriority
SetThreadPriority
GetCurrentThreadId
SwitchToThread
CreateThread
GetStartupInfoW
ExitProcess
GetExitCodeThread
TerminateProcess
GetCurrentProcess
TlsGetValue
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

setupapi

CM_Get_Device_ID_List_SizeW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiRemoveDevice
CM_Get_DevNode_Status
CM_Get_Device_ID_ListW
CM_Reenumerate_DevNode
CM_Locate_DevNodeA
CM_Locate_DevNodeW

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegDeleteTreeW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
ControlService
EnumDependentServicesW
StartServiceW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
InitiateSystemShutdownA
RegSetKeyValueW
RegCreateKeyExW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
IsValidSid
InitializeSid
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation

ole32

CoGetInterfaceAndReleaseStream
CoCreateGuid
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoReleaseMarshalData
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

rpcrt4

RpcServerListen
RpcServerInqBindings
NdrClientCall3
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcImpersonateClient
RpcRevertToSelfEx
I_RpcGetCurrentCallHandle
NdrServerCall2
RpcRaiseException
I_RpcGetBuffer
NdrComplexStructMarshall
NdrCorrelationInitialize
NdrCorrelationPass
NdrCorrelationFree
NdrComplexStructBufferSize
RpcStringFreeA
UuidToStringA
NdrComplexStructFree
NdrConvert
NdrServerInitializeNew
RpcServerUseProtseqEpW
RpcBindingVectorFree
RpcRevertToSelf
I_RpcBindingInqLocalClientPID
RpcStringFreeW
RpcStringBindingComposeW
RpcEpUnregister
RpcBindingFromStringBindingW
RpcEpRegisterW
RpcMgmtStopServerListening

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapFree
HeapSize
GetProcessHeap
HeapReAlloc
HeapAlloc

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetVersionExW
GetLogicalProcessorInformation

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
FreeLibraryAndExitThread
GetModuleHandleW
GetModuleHandleExW
GetModuleHandleA
GetProcAddress
LoadLibraryExW

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetOEMCP
EnumSystemLocalesW
GetUserDefaultLCID
GetLocaleInfoW
GetCPInfo
GetACP
LCMapStringW
FormatMessageW
IsValidLocale

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetThreadTimes
IsProcessorFeaturePresent

api-ms-win-appmodel-runtime-l1-1-0

GetPackageId
GetPackagePath

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW
K32GetModuleBaseNameW

wintrust

WinVerifyTrust

api-ms-win-core-file-l1-1-0

FindClose
SetFilePointerEx
DeleteFileW
FindNextFileW
CreateFileW
GetFinalPathNameByHandleW
FlushFileBuffers
GetFileType
FindFirstFileExW
CreateFileA
ReadFile
GetDiskFreeSpaceExA
WriteFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

api-ms-win-core-synch-ansi-l1-1-0

OpenMutexA
CreateSemaphoreA
CreateWaitableTimerA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentStringsW
SetStdHandle
GetStdHandle
GetCommandLineA
GetCommandLineW
SetEnvironmentVariableA

api-ms-win-core-file-ansi-l1-1-0

QueryDosDeviceA

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
QueryDepthSList
InterlockedPopEntrySList
InitializeSListHead
InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-console-l1-1-0

WriteConsoleW
ReadConsoleW
GetConsoleCP
GetConsoleMode

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??0scoped_c_thread_locale@details@utility@@QEAA@XZ
??0value@json@web@@QEAA@$$QEAV012@@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@H@Z
??0value@json@web@@QEAA@I@Z
??0value@json@web@@QEAA@N@Z
??0value@json@web@@QEAA@PEB_W@Z
??0value@json@web@@QEAA@PEB_W_N@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QEAA@XZ
??0value@json@web@@QEAA@_J@Z
??0value@json@web@@QEAA@_K@Z
??0value@json@web@@QEAA@_N@Z
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??1scoped_c_thread_locale@details@utility@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z
??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z
??8value@json@web@@QEBA_NAEBV012@@Z
??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@_K@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?array@value@json@web@@SA?AV123@_K@Z
?as_array@value@json@web@@QEAAAEAVarray@23@XZ
?as_array@value@json@web@@QEBAAEBVarray@23@XZ
?as_bool@value@json@web@@QEBA_NXZ
?as_double@value@json@web@@QEBANXZ
?as_integer@value@json@web@@QEBAHXZ
?as_number@value@json@web@@QEBAAEBVnumber@23@XZ
?as_object@value@json@web@@QEAAAEAVobject@23@XZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEAAAEAV123@_K@Z
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
?boolean@value@json@web@@SA?AV123@_N@Z
?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QEAAX_K@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?is_double@value@json@web@@QEBA_NXZ
?is_int32@number@json@web@@QEBA_NXZ
?is_int64@number@json@web@@QEBA_NXZ
?is_integer@value@json@web@@QEBA_NXZ
?is_uint32@number@json@web@@QEBA_NXZ
?keep_object_element_order@json@web@@YAX_N@Z
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z
?platform_category@details@utility@@YAAEBVerror_category@std@@XZ
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z
?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?windows_category@details@utility@@YAAEBVerror_category@std@@XZ
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskGetPartitionTableInfos
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiEventClose
IsiEventSetUpForAllWithHandle
IsiEventWaitWithHandle
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsRTD3HotEnabled
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetPhyHandles
IsiGetPhyInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiROHISetState
IsiRaidLevelModify
IsiReadPatrolSetState
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiToggleCoalescerPolicy
IsiUpdatePmInterfaceFields
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeConvertIrrtToRaid1
IsiVolumeConvertRaid1ToIrrt
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeIrrtCreate
IsiVolumeIrrtMountPartner
IsiVolumeIrrtSetAutomaticSync
IsiVolumeIrrtSetManualSync
IsiVolumeIrrtSwapDisks
IsiVolumeIrrtSync
IsiVolumeIrrtUnMountPartner
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 617KB - Virtual size: 617KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 617B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/iaStorAC.cat
drivers/intel 8th and 9th Gen Platforms/RAID/iaStorAC.inf
drivers/intel 8th and 9th Gen Platforms/RAID/iaStorAC.sys
.sys windows:10 windows x64 arch:x64

81e86f998a488764dff6fae597ff56d2

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f
Signer

Actual PE Digest

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f

Digest Algorithm

sha256

PE Digest Matches

true

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f
Signer

Actual PE Digest

90:a9:34:35:7f:5e:c9:d5:12:4a:3d:c7:4e:7b:51:61:90:8e:a4:9a:ae:64:6e:69:39:16:7c:2b:c6:8a:30:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Common\build\iaStorA\x64\Release\iaStorAC.pdb

Imports

storport.sys

StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortSetDeviceQueueDepth
StorPortExtendedFunction
StorPortGetScatterGatherList
StorPortNotification

ntoskrnl.exe

KeBugCheckEx
sprintf_s
KeQueryActiveProcessorCount
KeDeregisterBugCheckReasonCallback
KeRegisterBugCheckReasonCallback
sscanf_s
IoRegisterBootDriverReinitialization
KeQueryGroupAffinity
IoSetDevicePropertyData
MmIsAddressValid
RtlGetVersion
IoGetDevicePropertyData
atol
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
wcsnlen
MmGetPhysicalAddress
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryDpcWatchdogInformation
PsSetCreateProcessNotifyRoutineEx
_snwprintf_s
IoGetIoPriorityHint
strtok_s
strncmp
_purecall
__chkstk
KeLowerIrql
KeInitializeEvent
KfRaiseIrql
KeWaitForSingleObject
IoAllocateWorkItem
IoFreeWorkItem
strncpy
memcpy_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlCompareMemory
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
KeSetEvent
KeDelayExecutionThread
sprintf
_snprintf
strcmp
ZwOpenKey
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
strstr
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
ZwQueryValueKey
PoRegisterPowerSettingCallback
PoUnregisterPowerSettingCallback
EtwUnregister
EtwWrite
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
strnlen
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/iaStorAfs.sys
.sys windows:10 windows x64 arch:x64

b1a3c73d4692e1e4a34ed012f1b2a63e

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:2b:53:90:4e:2f:bd:48:8c:6c:6d:b8:8a:07:f0:77:49:40:0e:73:89:f4:28:2d:d7:14:29:6a:2a:5e:38:b4
Signer

Actual PE Digest

13:2b:53:90:4e:2f:bd:48:8c:6c:6d:b8:8a:07:f0:77:49:40:0e:73:89:f4:28:2d:d7:14:29:6a:2a:5e:38:b4

Digest Algorithm

sha256

PE Digest Matches

true

13:2b:53:90:4e:2f:bd:48:8c:6c:6d:b8:8a:07:f0:77:49:40:0e:73:89:f4:28:2d:d7:14:29:6a:2a:5e:38:b4
Signer

Actual PE Digest

13:2b:53:90:4e:2f:bd:48:8c:6c:6d:b8:8a:07:f0:77:49:40:0e:73:89:f4:28:2d:d7:14:29:6a:2a:5e:38:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfs.pdb

Imports

ntoskrnl.exe

ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlIsNtDdiVersionAvailable
RtlCompareMemory
IoWMIRegistrationControl
__C_specific_handler
_local_unwind
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
KeWaitForSingleObject
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeBugCheckEx
KeClearEvent
KeSetEvent
KeInitializeEvent
RtlInitUnicodeString
IoThreadToProcess
PsGetProcessId
PsSetCreateProcessNotifyRoutineEx
IoGetTopLevelIrp
KeAreApcsDisabled
ExAllocatePoolWithTag
memcpy_s
ExFreePoolWithTag
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
strcpy_s
KeWaitForMultipleObjects
_purecall

fltmgr.sys

FltObjectDereference
FltGetVolumeFromName
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseClientPort
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetFileContext
FltSupportsFileContexts
FltReleaseContext
FltSetFileContext
FltAllocateContext
FltQueryInformationFile
FltSendMessage

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/iaStorAfsNative.exe
.sys windows:5 windows x64 arch:x64

4f22e599ba6ed8ce074e352a789948fe

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:e4:a0:76:14:18:fc:44:b3:1f:42:5f:17:fb:8e:fa:f8:8b:02:be:74:57:7c:14:8a:f5:be:29:4d:ae:ca:6d
Signer

Actual PE Digest

65:e4:a0:76:14:18:fc:44:b3:1f:42:5f:17:fb:8e:fa:f8:8b:02:be:74:57:7c:14:8a:f5:be:29:4d:ae:ca:6d

Digest Algorithm

sha256

PE Digest Matches

true

65:e4:a0:76:14:18:fc:44:b3:1f:42:5f:17:fb:8e:fa:f8:8b:02:be:74:57:7c:14:8a:f5:be:29:4d:ae:ca:6d
Signer

Actual PE Digest

65:e4:a0:76:14:18:fc:44:b3:1f:42:5f:17:fb:8e:fa:f8:8b:02:be:74:57:7c:14:8a:f5:be:29:4d:ae:ca:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsNative.pdb

Imports

ntdll

RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
NtDisplayString
NtQueryInformationFile
NtCreateFile
NtDeviceIoControlFile
NtWaitForSingleObject
NtFsControlFile
NtReadFile
RtlCreateHeap
RtlDestroyHeap
RtlAllocateHeap
RtlFreeHeap
NtClose
NtWriteFile
NtWaitForMultipleObjects
NtDelayExecution
RtlCreateUserThread
ZwTerminateThread
NtCancelIoFile
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtCreateEvent
NtSetEvent
NtClearEvent

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/intel 8th and 9th Gen Platforms/RAID/iaStorAfsService.exe
.exe windows:6 windows x64 arch:x64

7a4a94414da602f1ce48584482ee086c

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:c8:be:0e:73:13:77:7e:72:4f:21:b5:93:42:49:ee:92:2b:d9:af:6a:97:fc:48:95:04:5a:f0:ab:4c:4e:77
Signer

Actual PE Digest

95:c8:be:0e:73:13:77:7e:72:4f:21:b5:93:42:49:ee:92:2b:d9:af:6a:97:fc:48:95:04:5a:f0:ab:4c:4e:77

Digest Algorithm

sha256

PE Digest Matches

true

95:c8:be:0e:73:13:77:7e:72:4f:21:b5:93:42:49:ee:92:2b:d9:af:6a:97:fc:48:95:04:5a:f0:ab:4c:4e:77
Signer

Actual PE Digest

95:c8:be:0e:73:13:77:7e:72:4f:21:b5:93:42:49:ee:92:2b:d9:af:6a:97:fc:48:95:04:5a:f0:ab:4c:4e:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\11566\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

Imports

fltlib

FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
WaitForSingleObjectEx
LeaveCriticalSection
SetEvent
EnterCriticalSection
TryEnterCriticalSection
ResetEvent
CreateEventW
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
CreateMutexW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
TlsAlloc
GetCurrentProcessId
ExitProcess
TerminateProcess
TlsFree
SetPriorityClass
GetCurrentThreadId
TlsGetValue
CreateThread
ExitThread
GetCurrentProcess
ResumeThread
TlsSetValue
GetStartupInfoW
SuspendThread

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-heap-l1-1-0

HeapCompact
HeapValidate
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapQueryInformation
HeapSize
HeapFree
HeapCreate
HeapAlloc

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
InitializeSid
IsValidSid
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthority
CopySid
EqualSid
GetSidLengthRequired
GetLengthSid

rpcrt4

RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcServerUseProtseqEpW
RpcAsyncAbortCall
RpcAsyncCompleteCall
RpcServerTestCancel
RpcBindingVectorFree
RpcServerInqBindings
RpcServerListen
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
RpcEpUnregister

userenv

UnloadUserProfile

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedFlushSList

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
LoadStringW

api-ms-win-core-file-l1-1-0

GetFullPathNameA
SetEndOfFile
UnlockFileEx
FindFirstFileExW
FindNextFileA
FindClose
CreateFileW
SetFilePointer
WriteFile
DeleteFileW
GetDiskFreeSpaceW
GetFullPathNameW
LockFile
FlushFileBuffers
GetFileSize
GetFinalPathNameByHandleW
GetFileSizeEx
GetDiskFreeSpaceA
FileTimeToLocalFileTime
ReadFile
CompareFileTime
FindFirstFileW
FindNextFileW
CreateDirectoryW
LockFileEx
GetFileAttributesA
GetFileType
SetFilePointerEx
FindFirstFileExA
GetFileAttributesW
SetFileAttributesW
UnlockFile
DeleteFileA
GetFileAttributesExW
CreateFileA

api-ms-win-core-io-l1-1-0

DeviceIoControl
CancelIoEx
GetOverlappedResult

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryValueExW
RegDeleteTreeW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
CoRevokeClassObject

oleaut32

SysAllocString
VariantInit
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString
VariantClear

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
GetTickCount64
GetSystemTime

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer
DeleteTimerQueueEx

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
GetSystemPowerStatus

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
FlushViewOfFile
MapViewOfFile
VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetCPInfo
IsValidLocale
EnumSystemLocalesW
GetOEMCP
GetLocaleInfoW
FormatMessageW
GetACP
GetUserDefaultLCID
IsValidCodePage
FormatMessageA

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-file-l1-2-2

AreFileApisANSI
FindFirstFileNameW
FindNextFileNameW
GetTempPathA

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx
ChangeServiceConfigW
ChangeServiceConfig2W
QueryServiceConfigW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
CreateServiceW
StartServiceW
OpenServiceW
DeleteService

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
GetStdHandle

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
ReadConsoleW
WriteConsoleW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 571KB - Virtual size: 570KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/MSPCManagerSetup.exe
.exe windows:6 windows x64 arch:x64

79574c1ac3cafe5a1679caaa53cdc84f

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:b0:c6:a4:66:13:cb:c9:b4:26:47:b8:b4:58:b3:81:e3:9d:ee:f3:d2:71:04:5e:57:d6:fd:ac:4b:81:66:d6
Signer

Actual PE Digest

6d:b0:c6:a4:66:13:cb:c9:b4:26:47:b8:b4:58:b3:81:e3:9d:ee:f3:d2:71:04:5e:57:d6:fd:ac:4b:81:66:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\installer_cpp\PCManagerInstaller\x64\Release\Setup.pdb

Imports

winhttp

WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

kernel32

GetDiskFreeSpaceExW
GetUserGeoID
GetGeoInfoW
LocalAlloc
WTSGetActiveConsoleSessionId
TerminateProcess
GetCurrentProcess
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
SetFilePointerEx
GetConsoleMode
HeapReAlloc
GetFileType
HeapFree
HeapAlloc
GetCurrentThread
GetStdHandle
GetModuleHandleExW
GetCPInfo
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RtlPcToFileHeader
RtlUnwindEx
RaiseException
InitializeSListHead
GetNativeSystemInfo
GetFileSizeEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
QueryPerformanceCounter
GetLocaleInfoEx
FormatMessageA
GetDriveTypeW
GetSystemTime
IsDebuggerPresent
GetTempPathW
ReleaseMutex
CreateMutexW
OpenMutexW
K32GetModuleFileNameExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OutputDebugStringW
FlushFileBuffers
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
GetUserDefaultUILanguage
lstrcpyW
lstrcpynW
lstrcmpiW
GetLocalTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesW
SetFilePointer
SetFileTime
WriteFile
CreateDirectoryW
FormatMessageW
DecodePointer
DeleteCriticalSection
GlobalAlloc
ExitProcess
MulDiv
GetCurrentProcessId
OpenProcess
VerSetConditionMask
VerifyVersionInfoW
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
GlobalUnlock
GlobalLock
ReadFile
GetFileSize
CreateFileW
lstrlenW
GetTickCount
WideCharToMultiByte
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
GetACP
MultiByteToWideChar
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleHandleW
LocalFree
GetCommandLineW
CloseHandle
CreateProcessW
GetLastError
GlobalFree
Sleep
FreeLibrary
GetProcAddress
LoadLibraryW
GetTickCount64
DeleteFileW
GetCurrentThreadId
GetProcessHeap
SetStdHandle
HeapSize
GetConsoleOutputCP
WriteConsoleW
CompareStringEx
LCMapStringEx
GetStartupInfoW

user32

IsWindowEnabled
UpdateLayeredWindow
GetMessageW
TranslateMessage
DispatchMessageW
OffsetRect
InflateRect
UnionRect
SetCursor
LoadCursorW
wsprintfW
DefWindowProcW
CreateWindowExW
SetWindowLongPtrW
IsWindow
ShowWindow
GetWindow
EnableWindow
SetFocus
PostQuitMessage
GetWindowRect
GetParent
GetMonitorInfoW
MonitorFromWindow
MoveWindow
LoadImageW
GetSystemMetrics
SendMessageW
RegisterClassW
SetWindowRgn
RegisterClassExW
GetWindowLongPtrW
CallWindowProcW
SetPropW
GetPropW
PostMessageW
GetClientRect
AdjustWindowRectEx
GetWindowLongW
GetMenu
CharNextW
PtInRect
ScreenToClient
GetKeyState
DestroyWindow
ReleaseDC
GetDC
SetWindowLongW
IsIconic
GetActiveWindow
BeginPaint
EndPaint
GetUpdateRect
IsRectEmpty
PostThreadMessageW
GetKeyNameTextW
CharPrevW
SetRect
FillRect
SetWindowPos
DrawTextW
IsWindowVisible
IntersectRect
MapWindowPoints
GetCursorPos
ReleaseCapture
GetSysColor
InvalidateRect
IsZoomed
GetWindowRgn
CreateCaret
ShowCaret
MonitorFromPoint
MessageBoxW
NotifyWinEvent
GetClassInfoExW
GetWindowTextLengthW
GetFocus
SetTimer
KillTimer
GetKeyboardLayout
MapVirtualKeyExW
SetForegroundWindow
DrawTextA
wsprintfA
GetGUIThreadInfo
CreateAcceleratorTableW
InvalidateRgn
GetWindowTextW
HideCaret
SetWindowTextW
EqualRect
UpdateWindow
DestroyMenu
TrackPopupMenu
EnableMenuItem
AppendMenuW
CreatePopupMenu
GetCaretBlinkTime
ClientToScreen
SetCaretPos
GetCaretPos
SetCapture

gdi32

GetBitmapBits
GetTextExtentPointA
CreatePatternBrush
PtInRegion
SetBitmapBits
GdiFlush
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
LineTo
MoveToEx
CreatePenIndirect
CreateSolidBrush
SetStretchBltMode
SetTextColor
SetBkMode
GetObjectA
StretchBlt
CreateDIBSection
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
CreateRoundRectRgn
PlayEnhMetaFile
CreateCompatibleBitmap
GetDeviceCaps
GetEnhMetaFileHeader
CreateDIBitmap
AddFontMemResourceEx
GetTextMetricsW
CloseEnhMetaFile
CreateEnhMetaFileW
SetWindowOrgEx
Rectangle
RestoreDC
BitBlt
SaveDC
SelectObject
CreateCompatibleDC
DeleteDC
RemoveFontMemResourceEx
DeleteObject
CreatePen
CreateFontIndirectW
GetStockObject
GetObjectW
CreateRectRgn

advapi32

RegCloseKey
RegCreateKeyExW
OpenProcessToken
EqualSid
OpenThreadToken
RegDeleteValueW
RegOpenKeyExW
RevertToSelf
ImpersonateLoggedOnUser
ConvertSidToStringSidW
GetTokenInformation
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyValueW
RegQueryValueExW

shell32

DragQueryFileW
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CLSIDFromProgID
CLSIDFromString
OleLockRunning
ReleaseStgMedium
CreateStreamOnHGlobal
CoCreateInstance
DoDragDrop
OleDuplicateData

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipDrawPath
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipSetSmoothingMode
GdipDrawRectangleI
GdipDrawImageRectI
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
GdiplusShutdown
GdiplusStartup
GdipImageSelectActiveFrame
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipSetPenDashStyle

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

shlwapi

PathFileExistsW
PathAppendW

ws2_32

WSAStartup
gethostname
gethostbyname
WSACleanup
FreeAddrInfoW
InetNtopW
GetAddrInfoW

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness
GetDpiForMonitor

Sections

.text
Size: 973KB - Virtual size: 973KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/OfficePersonalizzato/Configurazione2021x32.xml
net8.0-windows/Resources/OfficePersonalizzato/Configurazione2021x64.xml
net8.0-windows/Resources/OfficePersonalizzato/Configurazione365x32.xml
net8.0-windows/Resources/OfficePersonalizzato/Configurazione365x64.xml
net8.0-windows/Resources/OfficePersonalizzato/bin.exe
.exe windows:5 windows x86 arch:x86

939ec163c544639b31abb6dc89b27f8f

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:1a:82:61:18:5e:70:87:f8:25:b5:16:09:70:50:57:4a:b7:e5:b3:20:64:62:e9:7a:21:e1:93:e5:38:1f:d5
Signer

Actual PE Digest

30:1a:82:61:18:5e:70:87:f8:25:b5:16:09:70:50:57:4a:b7:e5:b3:20:64:62:e9:7a:21:e1:93:e5:38:1f:d5

Digest Algorithm

sha256

PE Digest Matches

true

30:1a:82:61:18:5e:70:87:f8:25:b5:16:09:70:50:57:4a:b7:e5:b3:20:64:62:e9:7a:21:e1:93:e5:38:1f:d5
Signer

Actual PE Digest

30:1a:82:61:18:5e:70:87:f8:25:b5:16:09:70:50:57:4a:b7:e5:b3:20:64:62:e9:7a:21:e1:93:e5:38:1f:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

d:\dbs\el\sep\target\x86\ship\click2run\en-us\SetupODT.pdb

Imports

advapi32

ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
EventWriteTransfer
EventRegister
EventUnregister
CreateWellKnownSid
CheckTokenMembership
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
GetFileSecurityW
SetFileSecurityW
RegNotifyChangeKeyValue
RevertToSelf
OpenThreadToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
RegEnumValueA
RegDeleteValueA
RegGetValueA
EventWrite

ole32

CoInitialize
CoCancelCall
CLSIDFromString
CoRevokeInitializeSpy
CoRegisterInitializeSpy
CreateStreamOnHGlobal
CoTaskMemAlloc
IIDFromString
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateGuid
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoEnableCallCancellation
CoDisableCallCancellation

gdi32

SetDCBrushColor
SetDCPenColor
GetTextMetricsW
CreateFontW
SetBkColor
SetTextColor
DeleteObject
Rectangle
GetStockObject
CreatePen
GetTextExtentPoint32W
GetDeviceCaps
SelectObject
CreateSolidBrush

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocString

kernel32

RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
EncodePointer
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
DeleteTimerQueueTimer
CloseHandle
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
CompareStringEx
LocalFree
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
CreateThread
GetCurrentThreadId
GetExitCodeThread
CreateEventExW
DeleteFileW
WriteFile
WideCharToMultiByte
IsWow64Process
GetModuleHandleExW
ExpandEnvironmentStringsW
GlobalFree
MultiByteToWideChar
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
CreateMutexW
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLocaleName
FlsFree
FlsAlloc
AttachConsole
AllocConsole
GetStdHandle
WriteConsoleW
FreeConsole
LocaleNameToLCID
FindClose
UnmapViewOfFile
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FormatMessageA
GetSystemTimeAsFileTime
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetTickCount64
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
GetProcessTimes
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
OpenProcess
GetVersionExW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetSystemDirectoryW
HeapAlloc
IsValidCodePage
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
CreateEventW
WaitForSingleObject
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
ReleaseSemaphore
WaitForSingleObjectEx
QueryDepthSList
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
TzSpecificLocalTimeToSystemTime
ReleaseMutex
GetTempPathW
GetLongPathNameW
ResetEvent
IsDebuggerPresent
GetFileAttributesExW
FindFirstFileExW
MoveFileExW
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
ReadFile
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
FlushFileBuffers
LockFileEx
UnlockFileEx
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
CreateFileMappingW
WaitForMultipleObjects
OpenThread
GetFileType
SetFilePointer
LockFile
UnlockFile
GetOverlappedResult
GetFileAttributesW
GetFileTime
ReplaceFileW
CopyFileW
GetTempFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
LockResource
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetCurrentThread
GetQueuedCompletionStatus
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
QueryUnbiasedInterruptTime
OutputDebugStringW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
LocalAlloc
GetThreadLocale
FindFirstFileW
lstrcmpW
FlushViewOfFile
GetFullPathNameW
ProcessIdToSessionId
DeleteFileA
GetTempPathA
GetCommandLineW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetPriorityClass
GetExitCodeProcess
K32EnumProcesses
GetTimeZoneInformation
IsValidLocale
GetLocaleInfoEx
LCIDToLocaleName
GetLocaleInfoW
ResolveLocaleName
GetUserPreferredUILanguages
GetACP
LCMapStringEx
GetSystemDefaultLCID
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetFileAttributesA
LoadLibraryExA
GetUserGeoID
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetDiskFreeSpaceA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
GetPhysicallyInstalledSystemMemory
GetProductInfo
SwitchToThread
InitializeCriticalSectionAndSpinCount
SleepConditionVariableCS
InitializeConditionVariable
InitOnceBeginInitialize
InitOnceComplete
GetFileInformationByHandleEx
GetStringTypeW
GetSystemPreferredUILanguages
K32GetProcessImageFileNameW
GetDateFormatW
GetTimeFormatW
GetDriveTypeW
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
CreateTimerQueueTimer
ExitProcess
CompareStringW
EnumSystemLocalesW
SetStdHandle
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualQuery
SetEvent
GetLocalTime

rstrtmgr

RmGetList
RmStartSession
RmRegisterResources

ws2_32

WSAStartup
WSACleanup
FreeAddrInfoW
GetAddrInfoW

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

setupapi

SetupIterateCabinetW

gdiplus

GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipCloneBrush
GdipFree
GdipLoadImageFromStream
GdipDrawImageRectI
GdiplusStartup
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipFillRectangleI
GdipDeleteBrush
GdipAlloc

rpcrt4

RpcStringFreeW
UuidToStringW

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 218KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/access.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/excel.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/onedrive.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/onenote.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/outlook.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/powerpoint.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/project.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/publisher.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/visio.png
.png
net8.0-windows/Resources/OfficePersonalizzato/immaginioffice/word.png
.png
net8.0-windows/Resources/PowerRun.exe
.exe windows:5 windows x86 arch:x86

870b8e75c7190e202e9c6c81dff1040c

Code Sign

79:9e:5f:0f:69:be:cb:93:49:4a:b3:10:ef:62:cc:c3
Certificate

Issuer

CN=Sordum Software

Not Before

15/08/2021, 21:00

Not After

31/07/2032, 21:00

Subject

CN=Sordum Software

Extended Key Usages

ExtKeyUsageCodeSigning

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19/05/2021, 05:42

Not After

18/05/2032, 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d7:71:aa:ce:fb:c5:63:43:78:29:d1:32:10:6c:cc:3a:11:7f:31:6f
Signer

Actual PE Digest

d7:71:aa:ce:fb:c5:63:43:78:29:d1:32:10:6c:cc:3a:11:7f:31:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

winmm

timeGetTime
waveOutSetVolume
mciSendStringW

comctl32

ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy

mpr

WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW

wininet

InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable

psapi

EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW

kernel32

HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
OutputDebugStringW
GetLocalTime
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
ResumeThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
HeapReAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
RtlUnwind
SetFilePointer
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
EnumResourceNamesW
SetEnvironmentVariableA

user32

SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
CopyImage
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
PeekMessageW
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
GetMenuItemID
TranslateMessage
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
keybd_event
LoadImageW
GetWindowLongW

gdi32

DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CopySid
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl

shell32

DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish

ole32

OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize

oleaut32

SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VarR8FromDec
VariantTimeToSystemTime
VariantClear
VariantCopy
VariantInit
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData

Sections

.text
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/Product Sans Black.ttf
net8.0-windows/Resources/Product Sans.ttf
net8.0-windows/Resources/RisorseCreaISO/Risorse/7z.dll
.dll windows:4 windows x64 arch:x64

4a683d6f78cddf7c7cda44d5a4669025

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

oleaut32

SysStringLen
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
SysAllocStringLen

user32

CharUpperW
CharPrevExA

advapi32

SystemFunction036

msvcrt

strcat
strcpy
realloc
memset
free
malloc
__CxxFrameHandler
strlen
strchr
strstr
wcscmp
strcmp
memmove
_CxxThrowException
memcpy
memcmp
_purecall
exit
__C_specific_handler
_beginthreadex
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Sleep
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
SetEvent
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
QueryPerformanceCounter
GetOEMCP
DeleteCriticalSection
LocalFileTimeToFileTime
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatusEx
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/RisorseCreaISO/Risorse/7z.exe
.exe windows:4 windows x64 arch:x64

c40fa24fe18adb90df2122ca10e52ab2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysStringLen
VariantClear
VariantCopy
SysAllocString
SysStringByteLen
SysFreeString
SysAllocStringLen

user32

CharUpperW

advapi32

LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken

msvcrt

_c_exit
_XcptFilter
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
_isatty
memcmp
_purecall
memset
strlen
wcsstr
_exit
wcscmp
strcmp
memmove
fflush
fputc
fputs
_iob
fgetc
fclose
free
malloc
__CxxFrameHandler
_CxxThrowException
memcpy
_cexit
__initenv
exit
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type

kernel32

ResumeThread
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
GetVersionExW
CloseHandle
WaitForSingleObject
VirtualFree
VirtualAlloc
GetConsoleMode
SetConsoleMode
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetProcessAffinityMask
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
DeviceIoControl
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW

Sections

.text
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/RisorseCreaISO/Risorse/OperaGXSetup.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/RisorseCreaISO/Risorse/PowerRun.exe
.exe windows:5 windows x86 arch:x86

870b8e75c7190e202e9c6c81dff1040c

Code Sign

79:9e:5f:0f:69:be:cb:93:49:4a:b3:10:ef:62:cc:c3
Certificate

Issuer

CN=Sordum Software

Not Before

15/08/2021, 21:00

Not After

31/07/2032, 21:00

Subject

CN=Sordum Software

Extended Key Usages

ExtKeyUsageCodeSigning

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19/05/2021, 05:42

Not After

18/05/2032, 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d7:71:aa:ce:fb:c5:63:43:78:29:d1:32:10:6c:cc:3a:11:7f:31:6f
Signer

Actual PE Digest

d7:71:aa:ce:fb:c5:63:43:78:29:d1:32:10:6c:cc:3a:11:7f:31:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

winmm

timeGetTime
waveOutSetVolume
mciSendStringW

comctl32

ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy

mpr

WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW

wininet

InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable

psapi

EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW

kernel32

HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
OutputDebugStringW
GetLocalTime
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
ResumeThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
HeapReAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
RtlUnwind
SetFilePointer
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
EnumResourceNamesW
SetEnvironmentVariableA

user32

SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
CopyImage
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
PeekMessageW
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
GetMenuItemID
TranslateMessage
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
keybd_event
LoadImageW
GetWindowLongW

gdi32

DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CopySid
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl

shell32

DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish

ole32

OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize

oleaut32

SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VarR8FromDec
VariantTimeToSystemTime
VariantClear
VariantCopy
VariantInit
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData

Sections

.text
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/RisorseCreaISO/Risorse/[AIMODS]-Store.exe
.exe windows:5 windows x86 arch:x86

367254f4e83f62f5437681fde2e55f48

Code Sign

3e:4b:04:17:96:77:d9:83:4c:1a:81:af:b8:22:78:a3
Certificate

Issuer

CN=DESKTOP-56CF5D3\\Nico

Not Before

31/05/2024, 15:28

Not After

31/05/2025, 21:28

Subject

CN=DESKTOP-56CF5D3\\Nico

c7:1f:57:0c:57:bd:62:71:5d:5c:40:64:a4:46:7d:32:f5:99:cf:a3:37:11:41:b4:1d:de:b1:6b:98:3f:6a:f6
Signer

Actual PE Digest

c7:1f:57:0c:57:bd:62:71:5d:5c:40:64:a4:46:7d:32:f5:99:cf:a3:37:11:41:b4:1d:de:b1:6b:98:3f:6a:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dbs\el\ddvsm\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

Imports

kernel32

OpenProcess
GetNativeSystemInfo
EndUpdateResourceW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
Sleep
ReadFile
GetTempPathW
GetCurrentProcess
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetModuleFileNameW
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
CopyFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
HeapSetInformation
SetFilePointer
GetDiskFreeSpaceExW
CreateFileW
VerSetConditionMask
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
GetCurrentProcessId
MulDiv
GetTickCount
GetExitCodeProcess
LoadLibraryW
GetTempFileNameW
SwitchToThread
FindNextFileW
UpdateResourceA
BeginUpdateResourceA
FindResourceA
lstrlenA
DeleteFileA
CreateFileA
UpdateResourceW
BeginUpdateResourceW
GetVersion
GetEnvironmentVariableA
LCMapStringEx
InitializeCriticalSectionEx
HeapReAlloc
HeapSize
WriteConsoleW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
OutputDebugStringW
SetEndOfFile
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
FindFirstFileW
FindClose
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
LCMapStringW
HeapFree
HeapAlloc
GetFileType
GetStringTypeW
GetACP
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
RaiseException
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle

gdi32

GetStockObject
EnumFontFamiliesExW
DeleteObject
CreateFontIndirectW
GetObjectW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateCompatibleDC

ole32

CoUninitialize
CoInitialize

secur32

GetComputerObjectNameW

shell32

SHGetMalloc
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA

user32

SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadIconW
LoadCursorW
SetClassLongW
SetCursor
GetWindowRect
GetClientRect
SetWindowTextW
ShowScrollBar
SetForegroundWindow
EnableWindow
MsgWaitForMultipleObjects
GetFocus
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
CreateDialogIndirectParamW
CreateDialogParamW
MoveWindow
ShowWindow
DestroyWindow
SendMessageW
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
GetDialogBaseUnits
MessageBoxA
ScreenToClient

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW
InternetCombineUrlW

msi

ord92
ord150
ord78
ord8

shlwapi

UrlUnescapeW

Exports

Exports

_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/RisorseCreaISO/Risorse/lower-ram-usage.reg
net8.0-windows/Resources/RisorseCreaISO/Risorse/oscdimg.exe
.exe windows:10 windows x64 arch:x64

2b559891862d734fae9c7518a336b076

Code Sign

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:fa:28:e4:9b:1d:63:db:76:41:b0:49:c7:84:74:5c:b8:1f:21:df:6e:c8:c6:63:26:35:97:a9:2e:19:a0:97
Signer

Actual PE Digest

93:fa:28:e4:9b:1d:63:db:76:41:b0:49:c7:84:74:5c:b8:1f:21:df:6e:c8:c6:63:26:35:97:a9:2e:19:a0:97

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

OSCDIMG.pdb

Imports

kernel32

GetVersionExA
SetErrorMode
GetSystemTime
SystemTimeToFileTime
SetFileApisToANSI
SetFileApisToOEM
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
lstrlenW
FindFirstFileW
FindFirstFileA
FindClose
GetLongPathNameW
GetLastError
GetLongPathNameA
HeapFree
CreateFileW
CreateFileA
CloseHandle
WaitForSingleObject
SetEvent
FileTimeToSystemTime
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
ReadFile
GetFileTime
GetFileInformationByHandle
FindNextFileA
FindNextFileW
GetOverlappedResult
SetEndOfFile
SetFilePointer
CreateEventA
WriteFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
InitializeCriticalSection
VirtualFree
SetConsoleCtrlHandler
ExitProcess
FormatMessageA
GetProcessHeap
HeapAlloc
VirtualAlloc
VirtualLock
ResetEvent
GetProcAddress
ReleaseSemaphore
CreateThread
WaitForMultipleObjects
SetThreadPriority
CreateSemaphoreA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep

msvcrt

_wcsicmp
strrchr
_stricmp
wcscpy_s
wcscat_s
strtok
_wfopen
fgetws
feof
fclose
fopen
fgets
swprintf_s
_strnicmp
_strtoui64
strtoul
tolower
atoi
srand
time
__C_specific_handler
vfprintf
_ultoa
rand
_wcsnicmp
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__setusermatherr
_initterm
_fmode
_commode
wcstok
?terminate@@YAXXZ
memset
wprintf
sprintf_s
strchr
wcschr
_strupr
wcsncmp
strcat_s
strcpy_s
exit
printf
fflush
wcsrchr
fprintf
__iob_func
memcmp
memcpy
strcmp

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/RisorseCreaISO/Risorse/start.ps1
.ps1
net8.0-windows/Resources/RisorseCreaISO/Risorse/start10.ps1
.ps1
net8.0-windows/Resources/RisorseCreaISO/Risorse/tweaks.bat
.bat .vbs
net8.0-windows/Resources/RisorseCreaISO/Risorse/tweaks10.bat
.bat .vbs
net8.0-windows/Resources/RisorseCreaISO/Risorse/unattend.xml
.xml
net8.0-windows/Resources/RisorseCreaISO/Risorse/unattend10.xml
.xml
net8.0-windows/Resources/RisorseCreaISO/Risorse/unattendstock.xml
.xml
net8.0-windows/Resources/RisorseCreaISO/Risorse/unattendx32.xml
.xml
net8.0-windows/Resources/RisorseCreaISO/Risorse/unpin_start_tiles.ps1
.ps1
net8.0-windows/Resources/RisorseCreaISO/isotool10.bat
net8.0-windows/Resources/RisorseCreaISO/isotool11.bat
net8.0-windows/Resources/Rufus4Lite.exe
.exe windows:6 windows x86 arch:x86

e41efb89eff99bc86f0dffb2a7bd82cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount64
GetOEMCP
GetUserDefaultUILanguage
GetLocaleInfoA
GetSystemDefaultLangID
ReadFile
GetVolumeInformationW
SetLastError
DeleteVolumeMountPointA
DeviceIoControl
GetDriveTypeA
QueryDosDeviceA
FindFirstVolumeA
GetVolumeInformationA
GetVolumeNameForVolumeMountPointA
MultiByteToWideChar
Sleep
GetLastError
SetVolumeMountPointA
CreateFileA
DefineDosDeviceA
CloseHandle
GetLogicalDriveStringsA
GetProcAddress
SetFilePointerEx
FindNextVolumeA
FindVolumeClose
GetModuleHandleW
WideCharToMultiByte
GetVolumeInformationByHandleW
LoadLibraryExW
FlushFileBuffers
WriteFile
SetThreadUILanguage
GetEnvironmentVariableW
WaitForSingleObject
CreateFileW
ExitThread
GetThreadUILanguage
DeleteFileW
SetFileAttributesA
GetLocalTime
GetOverlappedResult
CopyFileW
CreateDirectoryA
CreateEventA
SetFileTime
SetVolumeLabelA
SizeofResource
FindResourceA
LockResource
LoadResource
CreateDirectoryW
MoveFileA
CopyFileA
DeleteFileA
CreateThread
CreateSymbolicLinkW
GetTempFileNameW
EnumUILanguagesW
CreateNamedPipeA
GetCurrentProcess
PeekNamedPipe
SetFileAttributesW
SystemTimeToFileTime
GetSystemTime
IsWow64Process
GetModuleFileNameW
LocalFree
OutputDebugStringA
K32GetModuleFileNameExW
SetThreadPriority
CreateMutexA
K32GetProcessImageFileNameW
ReleaseMutex
SetEvent
TerminateThread
GetNativeSystemInfo
ReadProcessMemory
GetCurrentProcessId
QueryFullProcessImageNameW
GetFileType
GetExitCodeProcess
SetDefaultDllDirectories
GetFullPathNameW
GetFinalPathNameByHandleW
LoadLibraryExA
GetTempPathW
GetFileAttributesW
GetCurrentThreadId
GetSystemDirectoryW
UnmapViewOfFile
AttachConsole
SetDllDirectoryA
FreeConsole
FreeLibrary
GetConsoleWindow
CreateFileMappingW
MapViewOfFile
GetSystemWindowsDirectoryW
MulDiv
SetThreadAffinityMask
WaitForMultipleObjects
CreateEventW
GetCurrentThread
VerifyVersionInfoA
TerminateProcess
GetProcessAffinityMask
GetProductInfo
CreatePipe
LCIDToLocaleName
GetExitCodeThread
GetVersionExA
GetFileSize
VerSetConditionMask
CreateProcessW
GetModuleHandleA
FormatMessageW
CancelSynchronousIo
OutputDebugStringW
LoadLibraryW
GetFileSizeEx
RemoveDirectoryW
CancelIoEx
MoveFileExW
GetDiskFreeSpaceExA
GetVolumePathNameA
GetSystemDefaultLCID
GetUserDefaultLCID
GetProcessHeap
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetCPInfo
SetEndOfFile
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
DecodePointer
CompareStringW
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
GetTimeZoneInformation
ExitProcess
ReadConsoleW
SetStdHandle
GetFileAttributesExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetConsoleMode
GetConsoleOutputCP
WriteConsoleW
GetModuleHandleExW
GetStdHandle
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException

user32

SetWinEventHook
SystemParametersInfoW
CreateDialogIndirectParamW
DrawIconEx
FlashWindowEx
SetDlgItemTextA
LoadIconW
DialogBoxIndirectParamW
CreateIconIndirect
CopyRect
GetWindowInfo
DestroyIcon
OffsetRect
LoadStringW
ScreenToClient
GetIconInfo
CreateWindowExW
EnumChildWindows
GetWindow
CallWindowProcW
AdjustWindowRectEx
DefWindowProcW
MapDialogRect
InflateRect
CreateIconFromResourceEx
GetParent
UnhookWinEvent
LoadImageW
DrawTextW
GetWindowLongW
GetWindowTextLengthW
GetMessageW
GetKeyState
SetProcessDefaultLayout
GetWindowRect
DestroyWindow
GetDC
IsWindowVisible
SetWindowPos
EndDialog
GetSystemMetrics
MessageBeep
CreatePopupMenu
ShowWindow
DispatchMessageW
RedrawWindow
IsDialogMessageW
ClientToScreen
GetWindowTextA
SetDlgItemTextW
MapWindowPoints
SetWindowTextA
GetDlgItemTextW
MessageBoxA
GetSysColor
IsWindowEnabled
MoveWindow
DestroyMenu
DrawTextExW
DrawTextExA
TranslateMessage
SendDlgItemMessageA
ChangeWindowMessageFilterEx
SendMessageA
InsertMenuW
SetWindowLongW
TrackPopupMenuEx
GetClientRect
CharUpperBuffW
CheckDlgButton
PostQuitMessage
GetDesktopWindow
FindWindowA
ReleaseDC
BeginPaint
EndPaint
SendInput
EnableWindow
SetWindowTextW
IsWindow
GetDlgItem
InvalidateRect
PostMessageW
MessageBoxExW
GetWindowTextW
SendMessageW
IsDlgButtonChecked
GetKeyboardLayoutNameA
SetTimer
KillTimer
UpdateWindow

Sections

.text
Size: 757KB - Virtual size: 757KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/Resources/WIMToolkit.ps1
net8.0-windows/Resources/WinHubXCambioEdizione.bat
.bat .vbs
net8.0-windows/Resources/WinHubXOfficeAttivatore.cmd
.cmd .vbs
net8.0-windows/Resources/WinHubXOfficeScrubber.ps1
.ps1
net8.0-windows/Resources/WinHubXWSL.ps1
.ps1
net8.0-windows/Resources/WinHubXWindowsAttivatore.bat
.bat .vbs
net8.0-windows/Resources/icoWinHubX.ico
net8.0-windows/System.CodeDom.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:a3:9a:1f:6d:f3:90:61:6f:40:e2:3f:8c:bd:ea:1a:06:2c:1f:e4:3f:20:36:4a:dd:8b:60:d2:11:ff:26:5c
Signer

Actual PE Digest

bd:a3:9a:1f:6d:f3:90:61:6f:40:e2:3f:8c:bd:ea:1a:06:2c:1f:e4:3f:20:36:4a:dd:8b:60:d2:11:ff:26:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.CodeDom/Release/net8.0/System.CodeDom.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Configuration.ConfigurationManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:a6:92:57:0d:5c:52:de:68:ed:8b:b4:26:c7:c9:a9:4a:09:9e:6a:05:e5:4b:92:b3:f9:52:2d:6e:31:01:19
Signer

Actual PE Digest

62:a6:92:57:0d:5c:52:de:68:ed:8b:b4:26:c7:c9:a9:4a:09:9e:6a:05:e5:4b:92:b3:f9:52:2d:6e:31:01:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 419KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Diagnostics.EventLog.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:83:18:e1:04:40:57:a3:98:90:3a:0b:41:1a:60:3c:7f:36:b2:05:fe:0c:11:ef:d5:b1:d1:e3:40:3a:d8:d3
Signer

Actual PE Digest

3b:83:18:e1:04:40:57:a3:98:90:3a:0b:41:1a:60:3c:7f:36:b2:05:fe:0c:11:ef:d5:b1:d1:e3:40:3a:d8:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Diagnostics.EventLog/Release/net8.0/System.Diagnostics.EventLog.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.DirectoryServices.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:4d:0f:30:e1:94:a2:a6:1d:84:a1:aa:61:f1:1a:06:67:98:b4:0a:01:21:1d:f0:a0:a1:a3:7b:ac:8b:7c:f4
Signer

Actual PE Digest

f2:4d:0f:30:e1:94:a2:a6:1d:84:a1:aa:61:f1:1a:06:67:98:b4:0a:01:21:1d:f0:a0:a1:a3:7b:ac:8b:7c:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.DirectoryServices/Release/net8.0/System.DirectoryServices.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Management.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:96:b4:54:f5:5f:55:38:b2:6f:02:28:c9:f8:a9:f7:3d:7e:2b:9c:c0:7d:8c:3d:6f:f0:8e:5d:e5:99:31:ed
Signer

Actual PE Digest

b8:96:b4:54:f5:5f:55:38:b2:6f:02:28:c9:f8:a9:f7:3d:7e:2b:9c:c0:7d:8c:3d:6f:f0:8e:5d:e5:99:31:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Management/Release/net8.0/System.Management.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Security.Cryptography.Pkcs.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:0a:5c:a8:f0:c7:8d:e1:76:61:f1:fe:68:67:a2:b1:19:a1:26:e4:35:f5:c2:2c:f3:c6:76:15:ad:b0:be:1b
Signer

Actual PE Digest

cf:0a:5c:a8:f0:c7:8d:e1:76:61:f1:fe:68:67:a2:b1:19:a1:26:e4:35:f5:c2:2c:f3:c6:76:15:ad:b0:be:1b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Security.Cryptography.Pkcs/Release/net8.0/System.Security.Cryptography.Pkcs.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Security.Cryptography.ProtectedData.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:29:22:c4:6a:fe:98:d3:cd:fe:f8:80:b0:5f:b4:5c:b9:d4:cf:a6:5b:8b:49:98:db:57:7c:92:83:2f:c9:85
Signer

Actual PE Digest

43:29:22:c4:6a:fe:98:d3:cd:fe:f8:80:b0:5f:b4:5c:b9:d4:cf:a6:5b:8b:49:98:db:57:7c:92:83:2f:c9:85

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Security.Permissions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:37:87:cd:cd:36:c1:86:ff:3e:e2:6f:79:40:07:b7:7e:36:ec:05:aa:b9:d5:f2:58:30:08:5c:5c:22:30:e2
Signer

Actual PE Digest

37:37:87:cd:cd:36:c1:86:ff:3e:e2:6f:79:40:07:b7:7e:36:ec:05:aa:b9:d5:f2:58:30:08:5c:5c:22:30:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Security.Permissions/Release/net8.0/System.Security.Permissions.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/System.Windows.Extensions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a2:a3:29:fa:c4:78:31:a4:87:e0:63:6a:f9:03:15:b7:a5:83:8a:57:f7:e6:8a:be:0a:e8:8a:42:20:0d:fb:07
Signer

Actual PE Digest

a2:a3:29:fa:c4:78:31:a4:87:e0:63:6a:f9:03:15:b7:a5:83:8a:57:f7:e6:8a:be:0a:e8:8a:42:20:0d:fb:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Windows.Extensions/Release/net8.0/System.Windows.Extensions.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/WinHubX.deps.json
net8.0-windows/WinHubX.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\gabri\OneDrive\Desktop\WinHubX-main\WinHubX\obj\Debug\net8.0-windows\WinHubX.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 48.0MB - Virtual size: 48.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/WinHubX.exe
.exe windows:6 windows x64 arch:x64

6a91eb82bfd19d2706c7d43c46f7064e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

Imports

kernel32

FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
free
_callnewh
malloc

api-ms-win-crt-string-l1-1-0

toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
wcsftime

api-ms-win-crt-locale-l1-1-0

setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/WinHubX.pdb
net8.0-windows/WinHubX.runtimeconfig.json
net8.0-windows/runtimes/linux-arm/native/libpsl-native.so
.elf linux arm
net8.0-windows/runtimes/linux-arm64/native/libpsl-native.so
.elf linux aarch64
net8.0-windows/runtimes/linux-musl-x64/native/libpsl-native.so
.elf linux x64
net8.0-windows/runtimes/linux-x64/native/libpsl-native.so
.elf linux x64
net8.0-windows/runtimes/osx/native/libpsl-native.dylib
.dylib macos arch:arm64 arch:x64
net8.0-windows/runtimes/unix/lib/net8.0/System.Management.Automation.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:08

Not After

14/11/2024, 19:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b4:89:fa:7c:65:5f:64:0e:7c:92:9a:cf:e6:d0:8f:3a:8a:c1:e9:66:c6:c1:8c:66:e8:85:4d:02:f3:90:c8
Signer

Actual PE Digest

5c:b4:89:fa:7c:65:5f:64:0e:7c:92:9a:cf:e6:d0:8f:3a:8a:c1:e9:66:c6:c1:8c:66:e8:85:4d:02:f3:90:c8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/PowerShell/src/System.Management.Automation/obj/Release/net8.0/System.Management.Automation.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/unix/lib/netstandard1.6/Microsoft.Management.Infrastructure.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:02:63:40:72:37:ea:ee:e4:dc:40:9f:a2:e5:86:dc:18:76:75:a9:9b:9c:7f:d4:ae:a4:de:c8:18:b3:92:6a
Signer

Actual PE Digest

7e:02:63:40:72:37:ea:ee:e4:dc:40:9f:a2:e5:86:dc:18:76:75:a9:9b:9c:7f:d4:ae:a4:de:c8:18:b3:92:6a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/home/vsts/work/1/s/src/Microsoft.Management.Infrastructure/obj/Linux/netstandard2.0/Microsoft.Management.Infrastructure.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm/lib/net5.0/getfilesiginforedistwrapper.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:25:35:21:6f:36:08:7c:eb:06:00:00:00:00:04:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:16:6b:ef:f2:22:a2:37:75:f6:24:f2:49:58:2f:d9:75:fb:3b:90:95:98:ab:47:ec:a7:ff:4e:6e:76:60:f4
Signer

Actual PE Digest

2f:16:6b:ef:f2:22:a2:37:75:f6:24:f2:49:58:2f:d9:75:fb:3b:90:95:98:ab:47:ec:a7:ff:4e:6e:76:60:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedistwrapper.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm/native/PowerShell.Core.Instrumentation.dll
.dll windows:6 windows

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:3d:25:7f:f5:12:b5:9f:73:59:df:3b:15:f9:f3:db:8e:70:cc:b3:9d:4e:f4:b7:59:d3:11:ea:82:0b:c5:36
Signer

Actual PE Digest

60:3d:25:7f:f5:12:b5:9f:73:59:df:3b:15:f9:f3:db:8e:70:cc:b3:9d:4e:f4:b7:59:d3:11:ea:82:0b:c5:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm/native/getfilesiginforedist.dll
.dll windows:10 windows

3beea7858c99e30c0ff81cdfc1afab0d

Code Sign

33:00:00:04:25:35:21:6f:36:08:7c:eb:06:00:00:00:00:04:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:f1:4f:1c:cc:5a:68:2e:7e:f7:ca:2b:75:f2:5b:6c:74:63:e9:78:b1:2b:df:36:b1:e4:00:20:4d:34:b6:93
Signer

Actual PE Digest

2e:f1:4f:1c:cc:5a:68:2e:7e:f7:ca:2b:75:f2:5b:6c:74:63:e9:78:b1:2b:df:36:b1:e4:00:20:4d:34:b6:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedist.pdb

Imports

msvcrt

??1type_info@@UAA@XZ
memmove
strlen
memset
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_vsnwprintf
??3@YAXPAX@Z
_callnewh
_purecall
??0exception@@QAA@ABQBD@Z
??0exception@@QAA@ABQBDH@Z
??0exception@@QAA@ABV0@@Z
??1exception@@UAA@XZ
?what@exception@@UBAPBDXZ
_CxxThrowException
memcpy
strcmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

crypt32

CertOIDToAlgId
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertGetNameStringW
CertFindCertificateInStore
CertCloseStore
CertGetEnhancedKeyUsage
CryptDecodeObject
CertDuplicateCertificateContext
CertOpenStore
CertFreeCertificateContext

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WTHelperGetFileHash
CryptCATAdminCalcHashFromFileHandle

ext-ms-win-advapi32-safer-l1-1-0

SaferiSearchMatchingHashRules

kernel32

TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetFinalPathNameByHandleW
lstrlenW
LocalAlloc
CreateFileW
lstrcmpA
GetLastError
CloseHandle
LocalFree
GetCurrentProcess

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

GetSignatureInfo

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm/native/pwrshplugin.dll
.dll windows:6 windows

7d397f3efbbd54833c88e385d72221ee

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:6e:97:dc:38:cb:a4:49:30:a8:eb:4b:3d:d2:50:00:a7:85:97:88:61:ca:ee:fb:c2:49:13:ac:ed:6f:c2:60
Signer

Actual PE Digest

be:6e:97:dc:38:cb:a4:49:30:a8:eb:4b:3d:d2:50:00:a7:85:97:88:61:ca:ee:fb:c2:49:13:ac:ed:6f:c2:60

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\src\powershell-native\Bin\RELEASE\CoreClr\pwrshplugin.pdb

Imports

kernel32

GetLastError
RaiseException
DecodePointer
LocalFree
DeleteCriticalSection
LoadLibraryExW
LoadLibraryExA
GetModuleHandleExA
GetProcAddress
FreeLibrary
GetConsoleWindow
AllocConsole
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
GetModuleHandleW
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeCriticalSectionEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
ExpandEnvironmentStringsW
GetModuleFileNameW
ExpandEnvironmentStringsA
FormatMessageW
WideCharToMultiByte
GetModuleFileNameA
LeaveCriticalSection
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
LCMapStringEx
GetStringTypeW
MultiByteToWideChar
InitOnceExecuteOnce
CloseHandle
CreateFileW

ole32

CoInitializeEx
CoUninitialize

wsmsvc

WSManPluginOperationComplete

api-ms-win-crt-stdio-l1-1-0

_fseeki64
fsetpos
fflush
__stdio_common_vswprintf_s
ungetc
setvbuf
fgetpos
fwrite
fclose
fopen_s
fgetwc
fgetc
ungetwc
fputwc
_wfsopen
fseek

api-ms-win-crt-convert-l1-1-0

_itow_s
wcstoul

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh

api-ms-win-crt-string-l1-1-0

_wcsdup
islower
isupper
strlen
isspace
_wcsnicmp
strcpy_s
__strncnt
wcsnlen
strcmp
wcslen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
abort
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_errno

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

user32

ShowWindow

advapi32

RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales
___mb_cur_max_func
__pctype_func
___lc_codepage_func
___lc_locale_name_func
setlocale

Exports

Exports

GetCLRVersionForPSVersion
WSManPluginCommand
WSManPluginConnect
WSManPluginReceive
WSManPluginReleaseCommandContext
WSManPluginReleaseShellContext
WSManPluginSend
WSManPluginShell
WSManPluginShutdown
WSManPluginSignal
WSManPluginStartup

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm64/lib/net5.0/getfilesiginforedistwrapper.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:85:ad:4e:24:bd:ac:58:06:76:d8:6c:f4:56:19:97:3f:43:d4:3a:8e:4f:de:fc:02:d8:c4:f2:98:ec:93:80
Signer

Actual PE Digest

bf:85:ad:4e:24:bd:ac:58:06:76:d8:6c:f4:56:19:97:3f:43:d4:3a:8e:4f:de:fc:02:d8:c4:f2:98:ec:93:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedistwrapper.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm64/lib/netstandard1.6/microsoft.management.infrastructure.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:8c:fd:60:38:58:47:f8:4c:ce:18:a7:03:8a:af:87:58:68:18:77:02:cd:bd:04:24:fe:20:0a:c4:d2:0e:71
Signer

Actual PE Digest

d1:8c:fd:60:38:58:47:f8:4c:ce:18:a7:03:8a:af:87:58:68:18:77:02:cd:bd:04:24:fe:20:0a:c4:d2:0e:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-arm64/lib/netstandard1.6/microsoft.management.infrastructure.native.dll
net8.0-windows/runtimes/win-arm64/native/PowerShell.Core.Instrumentation.dll
net8.0-windows/runtimes/win-arm64/native/getfilesiginforedist.dll
net8.0-windows/runtimes/win-arm64/native/microsoft.management.infrastructure.native.unmanaged.dll
net8.0-windows/runtimes/win-arm64/native/pwrshplugin.dll
net8.0-windows/runtimes/win-x64/lib/net5.0/getfilesiginforedistwrapper.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:b7:4e:c6:ed:64:e6:8d:ba:35:09:7a:9f:05:1d:2a:0e:76:28:97:58:e0:0e:77:20:70:37:34:60:1d:5e:25
Signer

Actual PE Digest

fb:b7:4e:c6:ed:64:e6:8d:ba:35:09:7a:9f:05:1d:2a:0e:76:28:97:58:e0:0e:77:20:70:37:34:60:1d:5e:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedistwrapper.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x64/lib/netstandard1.6/microsoft.management.infrastructure.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:b4:17:6f:c6:ab:b8:7e:ef:ec:4e:0c:e9:a5:e1:7f:94:2e:10:fd:a0:5b:a5:1f:8b:78:91:1a:90:dc:e4:65
Signer

Actual PE Digest

61:b4:17:6f:c6:ab:b8:7e:ef:ec:4e:0c:e9:a5:e1:7f:94:2e:10:fd:a0:5b:a5:1f:8b:78:91:1a:90:dc:e4:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x64/lib/netstandard1.6/microsoft.management.infrastructure.native.dll
.dll windows:4 windows x64 arch:x64

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:2e:91:2e:a5:ef:82:c0:2f:5e:ba:0c:87:a5:90:dc:ae:02:80:b7:c1:37:0e:47:97:aa:6f:e3:ef:55:6a:49
Signer

Actual PE Digest

69:2e:91:2e:a5:ef:82:c0:2f:5e:ba:0c:87:a5:90:dc:ae:02:80:b7:c1:37:0e:47:97:aa:6f:e3:ef:55:6a:49

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.Native.pdb

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x64/native/PowerShell.Core.Instrumentation.dll
.dll windows:6 windows x64 arch:x64

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:c9:72:3e:7f:1b:a4:f2:e2:9c:68:7f:d9:60:56:20:49:fd:8f:6b:ca:ee:02:24:b7:11:de:e9:14:aa:28:f2
Signer

Actual PE Digest

e0:c9:72:3e:7f:1b:a4:f2:e2:9c:68:7f:d9:60:56:20:49:fd:8f:6b:ca:ee:02:24:b7:11:de:e9:14:aa:28:f2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x64/native/getfilesiginforedist.dll
.dll windows:10 windows x64 arch:x64

11d0c43662ec2e9ab59cc64ecfba8e8f

Code Sign

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:10:ed:c6:1f:a9:26:43:88:97:91:ce:0e:85:25:7d:26:fd:4f:78:44:9e:6e:ac:08:d0:01:83:51:66:84:33
Signer

Actual PE Digest

43:10:ed:c6:1f:a9:26:43:88:97:91:ce:0e:85:25:7d:26:fd:4f:78:44:9e:6e:ac:08:d0:01:83:51:66:84:33

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedist.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
memmove
memcpy
memset
_onexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
__dllonexit
_vsnwprintf
??3@YAXPEAX@Z
_callnewh
_purecall
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
strcmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

crypt32

CertFindCertificateInStore
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertOpenStore
CertOIDToAlgId
CertGetNameStringW
CertCloseStore
CertGetEnhancedKeyUsage
CryptDecodeObject
CertDuplicateCertificateContext
CertFreeCertificateContext

wintrust

CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
WTHelperGetFileHash
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
CryptCATAdminAcquireContext
WinVerifyTrust

ext-ms-win-advapi32-safer-l1-1-0

SaferiSearchMatchingHashRules

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
TerminateProcess
GetTickCount
GetSystemTimeAsFileTime
lstrlenW
GetCurrentThreadId
LocalAlloc
CreateFileW
lstrcmpA
Sleep
GetLastError
CloseHandle
LocalFree
GetCurrentProcessId
QueryPerformanceCounter
GetFinalPathNameByHandleW
UnhandledExceptionFilter

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

GetSignatureInfo

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x64/native/microsoft.management.infrastructure.native.unmanaged.dll
.dll windows:6 windows x64 arch:x64

59954ab072ae795ec13bcc0f0b1c0099

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:a6:3b:80:08:c4:b4:28:4c:fc:84:a8:d7:33:a2:a2:04:8b:ce:51:26:23:d9:92:f8:60:44:55:65:4b:55:78
Signer

Actual PE Digest

db:a6:3b:80:08:c4:b4:28:4c:fc:84:a8:d7:33:a2:a2:04:8b:ce:51:26:23:d9:92:f8:60:44:55:65:4b:55:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.Native.Unmanaged.pdb

Imports

msvcrt

_initterm
malloc
_amsg_exit
_XcptFilter
__C_specific_handler
free
memset

api-ms-win-core-threadpool-l1-2-0

CloseThreadpool
CreateThreadpoolWork
LeaveCriticalSectionWhenCallbackReturns
FreeLibraryWhenCallbackReturns
CreateThreadpool
SubmitThreadpoolWork
CloseThreadpoolWork
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum

api-ms-win-core-libraryloader-l1-1-1

FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-1

OpenThreadToken
GetCurrentProcess
GetCurrentProcessId
SetThreadToken
GetCurrentThread
TerminateProcess
GetCurrentThreadId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

mi

mi_clientFT_V1

Exports

Exports

GetAddr_OperationCallbacks_ClassObjectNeededCallback
GetAddr_OperationCallbacks_FreeIncludedFileBufferCallback
GetAddr_OperationCallbacks_GetIncludedFileBufferCallback
GetAddr_OperationCallbacks_NativeClassCallback
GetAddr_OperationCallbacks_NativeIndicationCallback
GetAddr_OperationCallbacks_NativeInstanceCallback
GetAddr_OperationCallbacks_NativePromptUserCallback
GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback
GetAddr_OperationCallbacks_NativeWriteErrorCallback
GetAddr_OperationCallbacks_NativeWriteMessageCallback
GetAddr_OperationCallbacks_NativeWriteProgressCallback
GetAddr_SessionHandle_OnReleaseHandleCompleted
MI_ApplicationWrapper_Initialize
MI_ApplicationWrapper_ScheduleCleanupCallback
MI_ApplicationWrapper_SetAppDomainIsUnloading
MI_Helpers_GetCurrentSecurityToken
MI_Helpers_IsClrShuttingDown
MI_Helpers_SetClrIsNotShuttingDown
MI_Helpers_SetClrIsShuttingDown
MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll
MI_OperationWrapper_DecrementCount_AndManageLifetimeOfMiDotNetDll
MI_OperationWrapper_GetClass
MI_OperationWrapper_GetIndication
MI_OperationWrapper_GetInstance
MI_OperationWrapper_Initialize
MI_OperationWrapper_ScheduleDrainingWorkIfNeeded
MI_OperationWrapper_SetupDrainingIfNeeded
UnmanagedMI_GetMiClientFT_V1
UnmanagedMI_GetMiEvaluatorFT_V1
UnmanagedMI_GetMiMonitoringFT_V1
UnmanagedMI_GetMiReactiveExtensionsFT_V1

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x64/native/pwrshplugin.dll
.dll windows:6 windows x64 arch:x64

a89a030199ea8eb12949392557b7cf62

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:af:37:e0:68:2f:fe:b8:f7:82:d3:0e:fb:66:07:85:8a:41:c8:59:f0:55:65:bf:2d:62:3f:c9:9a:fe:63:e7
Signer

Actual PE Digest

9f:af:37:e0:68:2f:fe:b8:f7:82:d3:0e:fb:66:07:85:8a:41:c8:59:f0:55:65:bf:2d:62:3f:c9:9a:fe:63:e7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\src\powershell-native\Bin\RELEASE\CoreClr\pwrshplugin.pdb

Imports

kernel32

GetLastError
RaiseException
DecodePointer
LocalFree
DeleteCriticalSection
LoadLibraryExW
LoadLibraryExA
GetModuleHandleExA
GetProcAddress
FreeLibrary
GetConsoleWindow
AllocConsole
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
InitializeCriticalSectionEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToThread
LCMapStringW
OutputDebugStringW
GetStringTypeW
ExpandEnvironmentStringsW
LeaveCriticalSection
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsA
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
CreateFileW
MultiByteToWideChar
FormatMessageW
GetCurrentProcessId
EnterCriticalSection

ole32

CoUninitialize
CoInitializeEx

wsmsvc

WSManPluginOperationComplete

api-ms-win-crt-stdio-l1-1-0

fopen_s
fflush
fputwc
ungetwc
fgetc
fgetwc
fclose
fgetpos
setvbuf
ungetc
fsetpos
__stdio_common_vswprintf_s
_fseeki64
fwrite
_wfsopen
fseek

api-ms-win-crt-convert-l1-1-0

_itow_s
wcstoul

api-ms-win-crt-heap-l1-1-0

calloc
free
_callnewh
malloc

api-ms-win-crt-string-l1-1-0

isupper
_wcsnicmp
_wcsdup
islower
wcsncmp
strcpy_s
__strncnt
wcsnlen
isspace

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm_e
terminate
abort
_errno
_initialize_onexit_table
_initterm

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

user32

ShowWindow

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-crt-locale-l1-1-0

setlocale
___lc_locale_name_func
_unlock_locales
_lock_locales
___mb_cur_max_func
__pctype_func
___lc_codepage_func

Exports

Exports

GetCLRVersionForPSVersion
WSManPluginCommand
WSManPluginConnect
WSManPluginReceive
WSManPluginReleaseCommandContext
WSManPluginReleaseShellContext
WSManPluginSend
WSManPluginShell
WSManPluginShutdown
WSManPluginSignal
WSManPluginStartup

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/lib/net5.0/getfilesiginforedistwrapper.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:03:6f:4b:f2:a7:a9:ad:1c:52:95:4b:00:d8:0b:59:7c:e5:f7:4f:86:c1:b7:68:bc:8d:17:08:bb:17:43:8c
Signer

Actual PE Digest

14:03:6f:4b:f2:a7:a9:ad:1c:52:95:4b:00:d8:0b:59:7c:e5:f7:4f:86:c1:b7:68:bc:8d:17:08:bb:17:43:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedistwrapper.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/lib/netstandard1.6/microsoft.management.infrastructure.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:90:3d:89:e6:d2:57:96:6d:eb:c7:35:56:a9:f6:e9:51:5d:a1:dc:33:68:9a:79:2e:9a:bf:d8:d2:51:41:71
Signer

Actual PE Digest

be:90:3d:89:e6:d2:57:96:6d:eb:c7:35:56:a9:f6:e9:51:5d:a1:dc:33:68:9a:79:2e:9a:bf:d8:d2:51:41:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/lib/netstandard1.6/microsoft.management.infrastructure.native.dll
.dll windows:4 windows x86 arch:x86

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:23:e3:b0:b0:49:65:7a:87:ac:c8:5c:60:f8:6f:a2:8b:85:84:ed:3b:fa:3d:21:95:85:26:cf:d9:0a:0c:f0
Signer

Actual PE Digest

c0:23:e3:b0:b0:49:65:7a:87:ac:c8:5c:60:f8:6f:a2:8b:85:84:ed:3b:fa:3d:21:95:85:26:cf:d9:0a:0c:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.Native.pdb

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/native/PowerShell.Core.Instrumentation.dll
.dll windows:6 windows x86 arch:x86

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:02:f6:66:4c:35:43:6c:9c:38:99:1d:c4:6f:4a:81:a4:d7:ac:de:68:c0:6a:35:b9:20:2d:b3:82:42:44:39
Signer

Actual PE Digest

f9:02:f6:66:4c:35:43:6c:9c:38:99:1d:c4:6f:4a:81:a4:d7:ac:de:68:c0:6a:35:b9:20:2d:b3:82:42:44:39

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/native/getfilesiginforedist.dll
.dll windows:10 windows x86 arch:x86

082021c452b36fa2d719fb05a6aea6bc

Code Sign

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:36:ca:fb:1c:b9:9e:d5:16:5e:dd:5a:57:5f:26:c5:c5:19:b4:01:d4:e6:d2:a8:3b:cc:b0:6f:f3:8e:f0:a9
Signer

Actual PE Digest

46:36:ca:fb:1c:b9:9e:d5:16:5e:dd:5a:57:5f:26:c5:c5:19:b4:01:d4:e6:d2:a8:3b:cc:b0:6f:f3:8e:f0:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

getfilesiginforedist.pdb

Imports

msvcrt

??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_vsnwprintf
??3@YAXPAX@Z
_callnewh
_purecall
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
memset

crypt32

CertOpenStore
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertOIDToAlgId
CertGetNameStringW
CertFindCertificateInStore
CertCloseStore
CertGetEnhancedKeyUsage
CryptDecodeObject
CertDuplicateCertificateContext
CertFreeCertificateContext

wintrust

CryptCATAdminEnumCatalogFromHash
WTHelperGetFileHash
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain

ext-ms-win-advapi32-safer-l1-1-0

SaferiSearchMatchingHashRules

kernel32

GetCurrentProcess
TerminateProcess
lstrlenW
GetFinalPathNameByHandleW
LocalAlloc
CreateFileW
lstrcmpA
GetLastError
CloseHandle
LocalFree
GetCurrentThreadId
Sleep
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

GetSignatureInfo

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/native/microsoft.management.infrastructure.native.unmanaged.dll
.dll windows:6 windows x86 arch:x86

7294dc917f59ebccda6cb56cffdda523

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:bc:f7:83:ea:bf:17:4b:b2:dd:d1:cd:76:5a:72:20:7c:9b:d4:2b:c2:3f:04:d3:09:a3:38:58:d8:db:28:b0
Signer

Actual PE Digest

60:bc:f7:83:ea:bf:17:4b:b2:dd:d1:cd:76:5a:72:20:7c:9b:d4:2b:c2:3f:04:d3:09:a3:38:58:d8:db:28:b0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.Native.Unmanaged.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
_amsg_exit
_XcptFilter
free
memset

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolWork
CloseThreadpoolWork
SetThreadpoolThreadMinimum
LeaveCriticalSectionWhenCallbackReturns
CloseThreadpool

api-ms-win-core-libraryloader-l1-1-1

LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
Sleep
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-1

OpenThreadToken
GetCurrentThreadId
SetThreadToken
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetTickCount
GetSystemTimeAsFileTime

mi

mi_clientFT_V1

Exports

Exports

GetAddr_OperationCallbacks_ClassObjectNeededCallback
GetAddr_OperationCallbacks_FreeIncludedFileBufferCallback
GetAddr_OperationCallbacks_GetIncludedFileBufferCallback
GetAddr_OperationCallbacks_NativeClassCallback
GetAddr_OperationCallbacks_NativeIndicationCallback
GetAddr_OperationCallbacks_NativeInstanceCallback
GetAddr_OperationCallbacks_NativePromptUserCallback
GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback
GetAddr_OperationCallbacks_NativeWriteErrorCallback
GetAddr_OperationCallbacks_NativeWriteMessageCallback
GetAddr_OperationCallbacks_NativeWriteProgressCallback
GetAddr_SessionHandle_OnReleaseHandleCompleted
MI_ApplicationWrapper_Initialize
MI_ApplicationWrapper_ScheduleCleanupCallback
MI_ApplicationWrapper_SetAppDomainIsUnloading
MI_Helpers_GetCurrentSecurityToken
MI_Helpers_IsClrShuttingDown
MI_Helpers_SetClrIsNotShuttingDown
MI_Helpers_SetClrIsShuttingDown
MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll
MI_OperationWrapper_DecrementCount_AndManageLifetimeOfMiDotNetDll
MI_OperationWrapper_GetClass
MI_OperationWrapper_GetIndication
MI_OperationWrapper_GetInstance
MI_OperationWrapper_Initialize
MI_OperationWrapper_ScheduleDrainingWorkIfNeeded
MI_OperationWrapper_SetupDrainingIfNeeded
UnmanagedMI_GetMiClientFT_V1
UnmanagedMI_GetMiEvaluatorFT_V1
UnmanagedMI_GetMiMonitoringFT_V1
UnmanagedMI_GetMiReactiveExtensionsFT_V1

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win-x86/native/pwrshplugin.dll
.dll windows:6 windows x86 arch:x86

05c8215f8c2b826489c67922a35baaf2

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:33:2e:16:4b:57:8b:54:8b:c5:de:be:4a:62:67:e6:32:76:4a:da:04:b9:79:1e:f4:a6:fc:5e:6c:c0:a5:48
Signer

Actual PE Digest

9b:33:2e:16:4b:57:8b:54:8b:c5:de:be:4a:62:67:e6:32:76:4a:da:04:b9:79:1e:f4:a6:fc:5e:6c:c0:a5:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\src\powershell-native\Bin\RELEASE\CoreClr\pwrshplugin.pdb

Imports

kernel32

GetLastError
RaiseException
DecodePointer
LocalFree
DeleteCriticalSection
LoadLibraryExW
LoadLibraryExA
GetModuleHandleExA
GetProcAddress
FreeLibrary
GetConsoleWindow
AllocConsole
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
FormatMessageW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToThread
GetStringTypeW
MultiByteToWideChar
CreateFileW
GetModuleHandleA
GetModuleFileNameA
WideCharToMultiByte
ExpandEnvironmentStringsA
GetModuleFileNameW
ExpandEnvironmentStringsW
LCMapStringW
OutputDebugStringW
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
EnterCriticalSection

ole32

CoUninitialize
CoInitializeEx

wsmsvc

WSManPluginOperationComplete

api-ms-win-crt-stdio-l1-1-0

_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fgetc
ungetwc
fputwc
fflush
fopen_s
fclose
__stdio_common_vswprintf_s
fgetwc
_wfsopen
fseek

api-ms-win-crt-convert-l1-1-0

wcstoul
_itow_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

isupper
_wcsnicmp
_wcsdup
islower
wcsncmp
strcpy_s
__strncnt
wcsnlen
isspace

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_crt_atexit
abort
terminate
_initterm_e
_initterm
_cexit
_register_onexit_function
_seh_filter_dll
_errno

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

user32

ShowWindow

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func
_lock_locales
___lc_codepage_func
setlocale
___mb_cur_max_func
__pctype_func
_unlock_locales

Exports

Exports

GetCLRVersionForPSVersion
WSManPluginCommand
WSManPluginConnect
WSManPluginReceive
WSManPluginReleaseCommandContext
WSManPluginReleaseShellContext
WSManPluginSend
WSManPluginShell
WSManPluginShutdown
WSManPluginSignal
WSManPluginStartup

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/Microsoft.PowerShell.CoreCLR.Eventing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:8b:4c:80:49:12:ef:79:e7:54:67:cd:92:2d:7b:34:e7:f5:6b:56:4b:28:fd:4d:fd:e3:77:06:27:fd:42:63
Signer

Actual PE Digest

2f:8b:4c:80:49:12:ef:79:e7:54:67:cd:92:2d:7b:34:e7:f5:6b:56:4b:28:fd:4d:fd:e3:77:06:27:fd:42:63

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\PowerShell\src\Microsoft.PowerShell.CoreCLR.Eventing\obj\Release\net8.0\Microsoft.PowerShell.CoreCLR.Eventing.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/Microsoft.Win32.Registry.AccessControl.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:bf:58:3d:53:67:02:c3:06:d5:9a:6e:bf:c1:77:aa:6c:19:3a:3d:f6:9c:e5:72:ea:9e:8c:80:b3:40:1f:67
Signer

Actual PE Digest

93:bf:58:3d:53:67:02:c3:06:d5:9a:6e:bf:c1:77:aa:6c:19:3a:3d:f6:9c:e5:72:ea:9e:8c:80:b3:40:1f:67

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/Release/net8.0-windows/Microsoft.Win32.Registry.AccessControl.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/System.Diagnostics.EventLog.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:f0:17:bb:11:4a:9c:c5:00:76:57:bf:13:4c:af:9a:5f:6c:db:a1:03:0c:90:ef:e9:cf:d4:f2:08:ed:ab:c3
Signer

Actual PE Digest

ce:f0:17:bb:11:4a:9c:c5:00:76:57:bf:13:4c:af:9a:5f:6c:db:a1:03:0c:90:ef:e9:cf:d4:f2:08:ed:ab:c3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Diagnostics.EventLog/Release/net8.0-windows/System.Diagnostics.EventLog.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/System.DirectoryServices.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:20:98:80:eb:10:1b:50:16:a1:87:04:7a:78:7a:d6:45:8c:9f:bf:ac:11:dc:9f:13:ff:e2:52:71:32:c5:d4
Signer

Actual PE Digest

7c:20:98:80:eb:10:1b:50:16:a1:87:04:7a:78:7a:d6:45:8c:9f:bf:ac:11:dc:9f:13:ff:e2:52:71:32:c5:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.DirectoryServices/Release/net8.0-windows/System.DirectoryServices.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 382KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/System.Management.Automation.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:08

Not After

14/11/2024, 19:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:ff:a5:07:c3:8a:b5:f6:d9:5d:43:d9:37:af:e9:45:6a:92:ad:62:c1:72:70:e9:55:0f:26:de:9e:5e:af:9f
Signer

Actual PE Digest

b7:ff:a5:07:c3:8a:b5:f6:d9:5d:43:d9:37:af:e9:45:6a:92:ad:62:c1:72:70:e9:55:0f:26:de:9e:5e:af:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\PowerShell\src\System.Management.Automation\obj\Release\net8.0\System.Management.Automation.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/System.Management.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:77:8d:dc:15:13:5f:8d:f7:74:af:cd:a0:90:66:08:03:f3:bf:ee:4b:1b:24:2b:69:b4:8c:4e:9f:11:64:aa
Signer

Actual PE Digest

49:77:8d:dc:15:13:5f:8d:f7:74:af:cd:a0:90:66:08:03:f3:bf:ee:4b:1b:24:2b:69:b4:8c:4e:9f:11:64:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/System.Security.Cryptography.Pkcs.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:20:5a:fb:fe:d2:f2:dd:02:db:b1:fa:b6:aa:40:a4:85:9d:f7:78:4f:5f:aa:01:d2:47:b5:b8:fe:57:24:83
Signer

Actual PE Digest

25:20:5a:fb:fe:d2:f2:dd:02:db:b1:fa:b6:aa:40:a4:85:9d:f7:78:4f:5f:aa:01:d2:47:b5:b8:fe:57:24:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Security.Cryptography.Pkcs/Release/net8.0-windows/System.Security.Cryptography.Pkcs.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 299KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
net8.0-windows/runtimes/win/lib/net8.0/System.Windows.Extensions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:44:2d:aa:ce:52:98:42:98:c7:41:1c:c5:68:74:38:f0:2c:ec:ca:ff:78:d9:90:95:53:70:f5:b6:03:2e:cb
Signer

Actual PE Digest

68:44:2d:aa:ce:52:98:42:98:c7:41:1c:c5:68:74:38:f0:2c:ec:ca:ff:78:d9:90:95:53:70:f5:b6:03:2e:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Windows.Extensions/Release/net8.0-windows/System.Windows.Extensions.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ee:25:e8:db:42:83:99:fe:c8:cc:1a:de:6d:db:f1:37:8a:c6:80:ae:75:03:b5:02:1e:c8:d0:45:3f:29:84:7eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 363KB - Virtual size: 363KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7bCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

0a:ca:6a:62:ef:fb:a4:09:65:00:a9:dc:bf:f0:81:a7:e3:c5:ae:11:52:a4:75:e5:e2:5f:e4:0c:d7:ad:db:57Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 7KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20Certificate

Key Usages

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73Certificate

Extended Key Usages

Key Usages

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 681KB - Virtual size: 681KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

4520d1114914143547e1eb10624e9b37

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ee:25:e8:db:42:83:99:fe:c8:cc:1a:de:6d:db:f1:37:8a:c6:80:ae:75:03:b5:02:1e:c8:d0:45:3f:29:84:7e
Signer

.text
Size: 363KB - Virtual size: 363KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

0a:ca:6a:62:ef:fb:a4:09:65:00:a9:dc:bf:f0:81:a7:e3:c5:ae:11:52:a4:75:e5:e2:5f:e4:0c:d7:ad:db:57
Signer

.text
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Signer

.text
Size: 681KB - Virtual size: 681KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

5e:bc:87:bb:12:81:a4:2a:91:ea:bc:f9:d1:7a:d2:75:80:30:84:f9:9c:62:55:9d:e7:d9:6a:4f:5f:2b:17:01
Signer

8a:63:3b:cb:d6:4d:66:e4:bc:70:a9:fa:84:f0:ba:71:2a:7c:64:b1
Signer

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 3.8MB

.pdata
Size: 2KB - Virtual size: 2KB

PAGE
Size: 1KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 512B - Virtual size: 56B

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

25:67:13:9a:89:f1:50:2c:90:45:d8:e7:41:12:b3:0b:fe:b3:fc:a4:d6:97:6d:bd:73:6c:88:28:3f:15:32:22
Signer

87:96:cb:8c:10:8c:99:0a:0a:51:85:9e:97:0f:82:8b:51:8c:51:bd
Signer

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 80B

.pdata
Size: 512B - Virtual size: 348B

PAGE
Size: 1024B - Virtual size: 855B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 512B - Virtual size: 32B

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate