ea42526c4d9077473b2e10e54ef8749b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ea42526c4d9077473b2e10e54ef8749b_JaffaCakes118
Size

3.7MB
MD5

ea42526c4d9077473b2e10e54ef8749b
SHA1

a529748738e898b6e14b3615cc0d26868755fb43
SHA256

31409717cb0a3cded90bbea64b70fe3290bb2da0dc2b8e9cbf3d28eb6dacbc8a
SHA512

6c428f932bbc45aff68cbcb6e313fd8dcfda627417fb0efa024988ae7bf7b1e06c0c316ca12b0bd4a5ed1944b51b78ccb32562c6d10adbc48b0501c29c2a3223
SSDEEP

98304:EiUnYbeVpMygZETQd8Ghk55Zg1CT8yivbFkM:Ei6YbeVpzYETQWGa5HWE8yivbFV

Score

3^/10

Malware Config

Signatures

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
ea42526c4d9077473b2e10e54ef8749b_JaffaCakes118
unpack001/$EXEDIR/UninstallToolPortable/App/Uninstall Tool/UninstallTool_x64.dat
unpack001/$EXEDIR/UninstallToolPortable/App/Uninstall Tool/UninstallTool_x86.dat
unpack001/$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/CisUtMonitor.sys
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/App/Uninstall Tool/UninstallTool_x64.dat
unpack001/App/Uninstall Tool/UninstallTool_x86.dat
unpack001/App/Uninstall Tool/x64/CisUtMonitor.sys
unpack001/CisUtMonitor.sys
unpack001/UninstallTool_x64.dat
unpack001/UninstallTool_x86.dat
unpack001/x64/CisUtMonitor.sys

Files

ea42526c4d9077473b2e10e54ef8749b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 996KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/RemoveService.cmd
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/UninstallTool.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/UninstallToolHelper.exe
.exe windows:5 windows x86 arch:x86

d290bdfeb2cc5f9b421f3b7c8b0446de

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a
Signer

Actual PE Digest

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a

Digest Algorithm

sha256

PE Digest Matches

true

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08
Signer

Actual PE Digest

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventW
CreateFileMappingW
OpenMutexW
UnmapViewOfFile
MapViewOfFile
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
SetEvent
GetProcAddress
CreateFileW
WriteConsoleW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
RaiseException
RtlUnwind
GetCommandLineW
GetLastError
HeapFree
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
LoadLibraryExW
GetConsoleCP
OutputDebugStringW
FlushFileBuffers
SetStdHandle

user32

MessageBoxA

advapi32

RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
RegSetValueExW

Sections

.text
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

10a9sz8k
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

k4x0ku6i
Size: 285KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

92n.vcof
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/UninstallTool_x64.dat
.exe windows:5 windows x64 arch:x64

d7511ed100c6dd5115c889f81ba7ab80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallTool.pdb

Imports

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathMatchSpecW
PathStripPathW
SHStrDupW
StrFormatByteSizeW
PathCompactPathW
ord487
PathParseIconLocationW
PathGetArgsW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsRelativeW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
FindResourceExW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
AreFileApisANSI
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlVirtualUnwind
UnhandledExceptionFilter
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
CreateFileW
CloseHandle
SetLastError
DeviceIoControl
SetEvent
ResetEvent
GetLocaleInfoW
CompareStringW
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
WaitForSingleObject
CreateEventW
TerminateThread
WaitForMultipleObjects
GetModuleHandleW
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
SuspendThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GlobalFree
QueryActCtxW
FindActCtxSectionStringW
FormatMessageA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
CreateDirectoryW
GetModuleHandleA
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetCurrentProcessId
VerifyVersionInfoW
GetUserDefaultUILanguage
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MulDiv
GetLastError
TerminateProcess
OpenProcess
lstrlenW
GetFileSize
ReadFile
GetCurrentProcess
GetSystemTime
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpynW
GetCurrentDirectoryW
Sleep
GetLocalTime
GetModuleFileNameW
lstrcatW
DeleteFileW
GetComputerNameW
SearchPathW
lstrcmpW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetSystemDefaultUILanguage
WinExec
GetTickCount
WriteFile
GetExitCodeThread
GetLongPathNameW
SetFilePointer
FileTimeToLocalFileTime
FileTimeToSystemTime
ResumeThread
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
OutputDebugStringA
GetACP
OutputDebugStringW
lstrcmpiW
GetFileAttributesExW
GetFileTime
LoadLibraryW
SystemTimeToFileTime
MoveFileExW
IsBadReadPtr
IsBadWritePtr
RemoveDirectoryW
SetFileAttributesW
LocalAlloc
LocalFree
FormatMessageW
CreateMutexW
OpenMutexW
lstrlenA
ExitProcess
LocalUnlock
LocalLock
GetVersionExW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
ExpandEnvironmentStringsW
VirtualProtect
GetNativeSystemInfo
GetVersion
SetUnhandledExceptionFilter
RtlCaptureContext
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThread
GetProcessTimes
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
lstrcpyW
GetCommandLineW
OpenEventW

user32

PostThreadMessageW
RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
IsIconic
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
CharNextW
GetWindowDC
ShowOwnedPopups
LoadMenuW
SendMessageW
EnableWindow
DestroyIcon
IsWindowVisible
GetNextDlgTabItem
EndDialog
IsWindowEnabled
SetDlgItemTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongPtrW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
ValidateRect
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
SetClassLongPtrW
SystemParametersInfoW
GetActiveWindow
GetWindowTextW
SetMenuDefaultItem
GetForegroundWindow
SetRectEmpty
IsRectEmpty
EqualRect
DefWindowProcW
GetClassInfoW
MessageBoxW
GetDesktopWindow
EnumWindows
GetDC
ReleaseDC
RegisterWindowMessageW
PostMessageW
IsWindow
GetFocus
GetKeyState
DrawTextW
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
SetRect
OffsetRect
PtInRect
GetParent
LoadCursorW
LoadImageW
DrawIconEx
GetIconInfo
GetSystemMetrics
GetWindowRect
SendMessageTimeoutW
GetWindowThreadProcessId
DrawFrameControl
GetMessagePos
SendDlgItemMessageA
WindowFromPoint
ShowScrollBar
GetUpdateRect
WinHelpW
IsDialogMessageW
GetLastActivePopup
SetWindowLongPtrW
GetWindowLongPtrW
MessageBeep
EndPaint
BeginPaint
DrawIcon
EnableMenuItem
GetSystemMenu
GetAsyncKeyState
GetDialogBaseUnits
CheckDlgButton
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
CreateIconIndirect
EnumDisplaySettingsW
FindWindowExW
FindWindowW
WaitForInputIdle
LoadStringW
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
ExitWindowsEx
GetMessageW
SetWindowLongW
GetWindowLongW
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AttachThreadInput
CharLowerBuffW
CreatePopupMenu
AppendMenuW
DrawTextExW
CharLowerBuffA
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DrawStateW
GetWindow
RedrawWindow
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateMDISysAccel
DefFrameProcW
DrawMenuBar
GetTabbedTextExtentA
SetWindowLongPtrA
GetWindowLongPtrA
IsWindowUnicode
GetClassLongW
SetCursorPos
GetDoubleClickTime
DrawEdge
LookupIconIdFromDirectoryEx
UnionRect
ShowCaret
HideCaret
GetWindowRgn
IsMenu
GetCursor
IsClipboardFormatAvailable
IsZoomed
MapVirtualKeyExW
GetKeyboardState
IsCharLowerW
GetKeyboardLayout
GetKeyboardLayoutList
DrawFocusRect
CopyRect
SetWindowPlacement
GetWindowPlacement
MoveWindow
FillRect
MapWindowPoints
SetWindowTextW
GetDlgItem
CharLowerW
LoadIconW
DeleteMenu
GetMenuItemCount
SetWindowPos
CopyIcon
GetClassNameW
KillTimer
SetTimer
SetForegroundWindow
GetMenuDefaultItem
TrackPopupMenu
UnregisterClassW
ClientToScreen
InsertMenuW
TabbedTextOutW
GrayStringW
CreateIconFromResourceEx
GetDCEx
LockWindowUpdate
InvertRect
wsprintfW
SetParent
SetWindowRgn
ToUnicodeEx
InflateRect

gdi32

GetDIBits
GetClipBox
CreateRectRgnIndirect
CreateBitmap
CreateDIBSection
DeleteDC
GetTextColor
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
Escape
BitBlt
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
MoveToEx
PolyBezierTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
PatBlt
ScaleWindowExtEx
GetMapMode
SetRectRgn
DPtoLP
GetTextMetricsW
GetRgnBox
EnumFontFamiliesExW
RestoreDC
RealizePalette
SaveDC
ExtSelectClipRgn
SetBkColor
SetBkMode
SetDIBitsToDevice
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
CreateDCW
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetPixel
CreatePatternBrush
ExcludeClipRect
GetClipRgn
GetCurrentPositionEx
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
SelectClipRgn
SetMapMode
SetTextAlign
SetPixel
Polygon
GetCurrentObject
ExtCreateRegion
PtInRegion
GetViewportOrgEx
CreateFontW
Polyline
Ellipse
GetCharWidthW
GetTextAlign
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
CreatePolygonRgn
GetWindowOrgEx
SetPixelV
FillRgn
FrameRgn
ScaleViewportExtEx
GetBitmapBits

msimg32

AlphaBlend
GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

GetTokenInformation
RegOpenKeyExW
RegCreateKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
CloseServiceHandle
ControlService
EnumServicesStatusExW
OpenSCManagerW
OpenServiceW
RegQueryValueW
RegEnumKeyW
RegEnumValueW
ConvertSidToStringSidW
LookupPrivilegeValueW
IsValidSid
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceConfigW

shell32

ShellExecuteExW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFileInfoW
CommandLineToArgvW
SHGetPathFromIDListW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetIconSize

uxtheme

DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeTypeEx
VarUdateFromDate
OleLoadPicturePath
VarBstrFromDate
SysAllocString
SysAllocStringLen
SysFreeString
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
VarDateFromStr

oledlg

OleUIBusyW
OleUIAddVerbMenuW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetSetOptionExW
InternetQueryOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW

winmm

PlaySoundW

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/UninstallTool_x86.dat
.exe windows:5 windows x86 arch:x86

28a35fedcf5f81c805d6cebcea3e68ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallTool-x86.pdb

Imports

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathMatchSpecW
PathStripPathW
SHStrDupW
StrFormatByteSizeW
PathCompactPathW
ord487
PathParseIconLocationW
PathGetArgsW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsRelativeW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW

kernel32

ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleExW
AreFileApisANSI
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
CreateFileW
CloseHandle
SetLastError
DeviceIoControl
SetEvent
ResetEvent
RtlUnwind
FindResourceExW
SetErrorMode
GetFileSizeEx
GetFileAttributesW
WaitForSingleObject
CreateEventW
TerminateThread
WaitForMultipleObjects
GetModuleHandleW
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
SuspendThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
FormatMessageA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetCurrentProcess
GetCurrentProcessId
VerifyVersionInfoW
GetUserDefaultUILanguage
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MulDiv
GetLastError
TerminateProcess
OpenProcess
lstrlenW
FileTimeToLocalFileTime
GetFileSize
ReadFile
GetSystemTime
GetSystemTimeAsFileTime
GetProcAddress
FileTimeToDosDateTime
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
LoadLibraryA
lstrcpynW
GetCurrentDirectoryW
Sleep
GetLocalTime
GetModuleFileNameW
lstrcatW
DeleteFileW
GetComputerNameW
SearchPathW
lstrcmpW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
WinExec
GetTickCount
WriteFile
GetExitCodeThread
CreateThread
GetLongPathNameW
SetFilePointer
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GlobalFree
GetModuleHandleA
FileTimeToSystemTime
ResumeThread
lstrcmpiW
GetFileAttributesExW
GetFileTime
SystemTimeToFileTime
MoveFileExW
IsBadReadPtr
IsBadWritePtr
RemoveDirectoryW
SetFileAttributesW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageW
OutputDebugStringA
GetACP
OutputDebugStringW
lstrlenA
ExitProcess
LocalUnlock
LocalLock
GetVersionExW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
ExpandEnvironmentStringsW
VirtualProtect
GetNativeSystemInfo
GetVersion
SetUnhandledExceptionFilter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThread
GetProcessTimes
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
lstrcpyW
OpenEventW
OpenMutexW
CreateMutexW
GetCommandLineW

user32

PostThreadMessageW
RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
IsIconic
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
SendMessageW
EnableWindow
DestroyIcon
IsWindowVisible
GetKeyNameTextW
IntersectRect
CharNextW
GetWindowDC
ShowOwnedPopups
LoadMenuW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
SetDlgItemTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
ValidateRect
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetMenuItemID
GetSubMenu
GetMenuState
InflateRect
SetClassLongW
GetActiveWindow
GetWindowTextW
SystemParametersInfoW
SetMenuDefaultItem
GetForegroundWindow
SetRectEmpty
IsRectEmpty
EqualRect
DefWindowProcW
MessageBoxW
GetDesktopWindow
EnumWindows
GetDC
ReleaseDC
RegisterWindowMessageW
PostMessageW
IsWindow
GetFocus
GetKeyState
DrawTextW
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
SetRect
OffsetRect
PtInRect
GetParent
LoadCursorW
LoadImageW
DrawIconEx
GetIconInfo
GetSystemMetrics
GetWindowRect
SendMessageTimeoutW
GetWindowThreadProcessId
MessageBoxA
DrawFrameControl
GetMenuStringW
SendDlgItemMessageA
WindowFromPoint
ShowScrollBar
GetUpdateRect
WinHelpW
IsDialogMessageW
GetLastActivePopup
MessageBeep
EndPaint
BeginPaint
DrawIcon
EnableMenuItem
GetSystemMenu
GetAsyncKeyState
GetDialogBaseUnits
CheckDlgButton
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
CreateIconIndirect
EnumDisplaySettingsW
FindWindowExW
FindWindowW
WaitForInputIdle
LoadStringW
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
ExitWindowsEx
GetMessageW
SetWindowLongW
GetWindowLongW
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AttachThreadInput
CharLowerBuffW
GetMessagePos
CreatePopupMenu
GetClassInfoW
CharLowerBuffA
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DrawStateW
GetWindow
RedrawWindow
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateMDISysAccel
DefFrameProcW
DrawMenuBar
GetTabbedTextExtentA
SetWindowLongA
GetWindowLongA
IsWindowUnicode
SetCursorPos
GetDoubleClickTime
DrawEdge
LookupIconIdFromDirectoryEx
UnionRect
ShowCaret
HideCaret
GetWindowRgn
IsMenu
GetCursor
IsClipboardFormatAvailable
IsZoomed
MapVirtualKeyExW
GetKeyboardState
IsCharLowerW
GetKeyboardLayout
GetKeyboardLayoutList
ToUnicodeEx
SetWindowRgn
AppendMenuW
DrawFocusRect
SetWindowPlacement
GetWindowPlacement
MoveWindow
FillRect
MapWindowPoints
SetWindowTextW
GetDlgItem
CharLowerW
LoadIconW
DeleteMenu
GetMenuItemCount
SetWindowPos
CopyIcon
GetClassNameW
KillTimer
SetTimer
SetForegroundWindow
GetMenuDefaultItem
TrackPopupMenu
UnregisterClassW
ClientToScreen
InsertMenuW
TabbedTextOutW
GrayStringW
DrawTextExW
CreateIconFromResourceEx
GetDCEx
LockWindowUpdate
InvertRect
wsprintfW
SetParent
CopyRect

gdi32

RealizePalette
RestoreDC
GetDIBits
GetClipBox
CreateRectRgnIndirect
CreateBitmap
GetBitmapBits
CreateDIBSection
DeleteDC
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
Escape
BitBlt
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextColor
SaveDC
SetRectRgn
DPtoLP
GetTextMetricsW
GetRgnBox
EnumFontFamiliesExW
ExtSelectClipRgn
SetBkColor
SetBkMode
SetDIBitsToDevice
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
CreateDCW
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetPixel
CreatePatternBrush
ExcludeClipRect
GetClipRgn
GetCurrentPositionEx
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
SelectClipRgn
SetMapMode
SetTextAlign
SetPixel
Polygon
GetCurrentObject
ExtCreateRegion
PtInRegion
GetViewportOrgEx
CreateFontW
Polyline
Ellipse
GetCharWidthW
GetTextAlign
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
CreatePolygonRgn
GetWindowOrgEx
SetPixelV
FillRgn
FrameRgn
MoveToEx
PolyBezierTo
GetMapMode
PatBlt
SetViewportExtEx

msimg32

AlphaBlend
GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegCreateKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegQueryInfoKeyW
CloseServiceHandle
RegQueryValueW
RegEnumKeyW
RegEnumValueW
ConvertSidToStringSidW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
ControlService

shell32

ShellExecuteExW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFileInfoW
CommandLineToArgvW
SHGetPathFromIDListW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetIconSize

uxtheme

DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeTypeEx
VarUdateFromDate
OleLoadPicturePath
VarBstrFromDate
SysAllocString
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
VarDateFromStr

oledlg

OleUIBusyW
OleUIAddVerbMenuW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetSetOptionExW
InternetQueryOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW

winmm

PlaySoundW

Exports

Exports

_EXECryptor_AntiDebug@0
_EXECryptor_DecodeSerialNumber@16
_EXECryptor_DecodeSerialNumberW@16
_EXECryptor_DecryptStr@8
_EXECryptor_DecryptStrW@8
_EXECryptor_EncryptStr@8
_EXECryptor_EncryptStrW@8
_EXECryptor_GetDate@0
_EXECryptor_GetEXECryptorVersion@0
_EXECryptor_GetHardwareID@0
_EXECryptor_GetProcAddr@8
_EXECryptor_GetReleaseDate@0
_EXECryptor_GetTrialDaysLeft@4
_EXECryptor_GetTrialRunsLeft@4
_EXECryptor_IsAppProtected@0
_EXECryptor_IsRegistered@0
_EXECryptor_MessageBoxA@16
_EXECryptor_ProtectImport@0
_EXECryptor_RegConst_0@0
_EXECryptor_RegConst_1@0
_EXECryptor_RegConst_2@0
_EXECryptor_RegConst_3@0
_EXECryptor_RegConst_4@0
_EXECryptor_RegConst_5@0
_EXECryptor_RegConst_6@0
_EXECryptor_RegConst_7@0
_EXECryptor_SecureRead@8
_EXECryptor_SecureReadW@8
_EXECryptor_SecureWrite@8
_EXECryptor_SecureWriteW@8
_EXECryptor_VerifySerialNumber@16
_EXECryptor_VerifySerialNumberW@16

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 603KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Arabic.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Armenian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Azerbaijani.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Belarusian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Bulgarian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Chinese_Simplified.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Chinese_Traditional.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Croatian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Czech.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Danish.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Dutch.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/English.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Estonian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/French.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Georgian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/German.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Greek.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Hebrew.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Hindi.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Hungarian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Indonesian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Italian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Japanese.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Korean.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Latvian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Lithuanian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Norwegian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Persian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Polish.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Portuguese.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Portuguese_Brazilian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Romanian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Russian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Serbian_Cyrillic.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Serbian_Latin.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Slovak.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Spanish.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Swedish.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Turkish.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Ukrainian.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/languages/Vietnamese.xml
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/license.dat
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/CisUtMonitor.inf
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/CisUtMonitor.sys
.sys windows:6 windows x64 arch:x64

f43b6ef93625d306e6fdaf0ae00f11b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\_prog\exlade\cidriver\driver\cisutmonitor\obj_release\amd64\CisUtMonitor.pdb

Imports

ntoskrnl.exe

ExDeletePagedLookasideList
IoUnregisterShutdownNotification
ExEventObjectType
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
PsGetVersion
ExInterlockedRemoveHeadList
CmRegisterCallback
IoCreateSymbolicLink
ExInitializePagedLookasideList
ObfDereferenceObject
IoCreateDevice
CmUnRegisterCallback
DbgPrint
ExDeleteNPagedLookasideList
IoThreadToProcess
KeSetEvent
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
PsGetProcessId
KeReleaseMutex
ExAllocatePoolWithTag
_wcsnicmp
RtlCheckRegistryKey
ZwQueryValueKey
RtlCompareUnicodeString
RtlConvertSidToUnicodeString
ZwOpenThreadTokenEx
RtlTimeToSecondsSince1970
MmGetSystemRoutineAddress
ZwOpenProcessTokenEx
ObQueryNameString
ExSystemTimeToLocalTime
ZwClose
ZwOpenProcess
RtlCopyUnicodeString
MmIsAddressValid
ZwQueryInformationToken
ZwOpenKey
KeBugCheckEx
PsSetCreateProcessNotifyRoutine
ExpInterlockedPushEntrySList
IoDeleteDevice
RtlInitUnicodeString
ExInitializeNPagedLookasideList
KeInitializeMutex
IoRegisterShutdownNotification
ExFreePoolWithTag
_wcsicmp
IoDeleteSymbolicLink
__C_specific_handler

fltmgr.sys

FltReleaseFileNameInformation
FltCloseCommunicationPort
FltGetFileNameInformation
FltGetDestinationFileNameInformation
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltParseFileNameInformation

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/UninstallTool.cpl
.dll windows:5 windows x64 arch:x64

9c93178cd8afc64354965ebaf62e32da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d
Signer

Actual PE Digest

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d

Digest Algorithm

sha256

PE Digest Matches

true

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2
Signer

Actual PE Digest

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
CloseHandle
lstrcpyW
lstrcatW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetVersionExW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
CreateFileW

user32

LoadIconW
LoadStringW

shell32

ShellExecuteW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW

Exports

Exports

CPlApplet

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/utshellext.dll
.dll regsvr32 windows:5 windows x64 arch:x64

99a462a3c8c3959a8c3fd90e70a36a53

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4
Signer

Actual PE Digest

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4

Digest Algorithm

sha256

PE Digest Matches

true

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45
Signer

Actual PE Digest

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x64\utshellext.pdb

Imports

kernel32

GetProcessHeap
FreeLibrary
ExpandEnvironmentStringsW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineA
GetCurrentThreadId
ReadFile
HeapReAlloc
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LoadLibraryExW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetModuleHandleA
FormatMessageA
HeapAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
LoadLibraryW
lstrlenW
LocalFree
GetProcAddress
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetModuleHandleW
GetLastError

user32

DrawIconEx
LoadImageW
GetParent
InsertMenuItemW
InsertMenuW
DestroyIcon
CreateIconIndirect
GetSystemMetrics
GetDC
ReleaseDC
MessageBoxW
GetActiveWindow
SetRect
GetIconInfo
GetMenuItemCount

gdi32

CreateDIBSection
SelectObject
GetDIBits
DeleteObject
CreateCompatibleDC
RealizePalette
GetObjectW
GetDeviceCaps
DeleteDC

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

shell32

SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW

ole32

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x64/utshellext_x86.dll
.dll regsvr32 windows:5 windows x86 arch:x86

d741819920c69dba2e85324aae1717a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:5f:57:74:3b:35:a6:4e:b1:dc:9e:ed:19:59:53:78:36:2b:54:54:a5:4b:cb:45:be:de:ca:54:81:0f:4f:f2
Signer

Actual PE Digest

2f:5f:57:74:3b:35:a6:4e:b1:dc:9e:ed:19:59:53:78:36:2b:54:54:a5:4b:cb:45:be:de:ca:54:81:0f:4f:f2

Digest Algorithm

sha256

PE Digest Matches

true

85:2d:4d:b0:ef:19:2e:b8:17:08:71:41:57:35:d1:d2:84:c8:d3:11
Signer

Actual PE Digest

85:2d:4d:b0:ef:19:2e:b8:17:08:71:41:57:35:d1:d2:84:c8:d3:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x86\utshellext.pdb

Imports

kernel32

HeapAlloc
HeapFree
GetProcessHeap
FreeLibrary
ExpandEnvironmentStringsW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlUnwind
RaiseException
GetCommandLineA
GetCurrentThreadId
ReadFile
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
FindResourceW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LoadLibraryExW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetModuleHandleA
FormatMessageA
SizeofResource
LockResource
LoadResource
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
LoadLibraryW
lstrlenW
LocalFree
GetProcAddress
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetModuleHandleW
GetLastError
InterlockedDecrement
InterlockedIncrement

user32

DrawIconEx
LoadImageW
GetParent
InsertMenuItemW
InsertMenuW
DestroyIcon
CreateIconIndirect
GetSystemMetrics
CharLowerBuffW
GetDC
ReleaseDC
MessageBoxW
GetActiveWindow
SetRect
GetIconInfo
GetMenuItemCount

gdi32

CreateDIBSection
SelectObject
GetDIBits
DeleteObject
CreateCompatibleDC
RealizePalette
GetObjectW
GetDeviceCaps
DeleteDC

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW

ole32

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x86/CisUtMonitor.inf
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x86/UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$EXEDIR/UninstallToolPortable/App/Uninstall Tool/x86/utshellext.dll
.dll regsvr32 windows:5 windows x86 arch:x86

d741819920c69dba2e85324aae1717a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:5f:57:74:3b:35:a6:4e:b1:dc:9e:ed:19:59:53:78:36:2b:54:54:a5:4b:cb:45:be:de:ca:54:81:0f:4f:f2
Signer

Actual PE Digest

2f:5f:57:74:3b:35:a6:4e:b1:dc:9e:ed:19:59:53:78:36:2b:54:54:a5:4b:cb:45:be:de:ca:54:81:0f:4f:f2

Digest Algorithm

sha256

PE Digest Matches

true

85:2d:4d:b0:ef:19:2e:b8:17:08:71:41:57:35:d1:d2:84:c8:d3:11
Signer

Actual PE Digest

85:2d:4d:b0:ef:19:2e:b8:17:08:71:41:57:35:d1:d2:84:c8:d3:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x86\utshellext.pdb

Imports

kernel32

HeapAlloc
HeapFree
GetProcessHeap
FreeLibrary
ExpandEnvironmentStringsW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlUnwind
RaiseException
GetCommandLineA
GetCurrentThreadId
ReadFile
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
FindResourceW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LoadLibraryExW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetModuleHandleA
FormatMessageA
SizeofResource
LockResource
LoadResource
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
LoadLibraryW
lstrlenW
LocalFree
GetProcAddress
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetModuleHandleW
GetLastError
InterlockedDecrement
InterlockedIncrement

user32

DrawIconEx
LoadImageW
GetParent
InsertMenuItemW
InsertMenuW
DestroyIcon
CreateIconIndirect
GetSystemMetrics
CharLowerBuffW
GetDC
ReleaseDC
MessageBoxW
GetActiveWindow
SetRect
GetIconInfo
GetMenuItemCount

gdi32

CreateDIBSection
SelectObject
GetDIBits
DeleteObject
CreateCompatibleDC
RealizePalette
GetObjectW
GetDeviceCaps
DeleteDC

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW

ole32

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:5 windows x86 arch:x86

8700d0ebbb41c81ea52718af1ab70a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess

user32

CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
App/Uninstall Tool/RemoveService.cmd
App/Uninstall Tool/UninstallTool.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
App/Uninstall Tool/UninstallToolHelper.exe
.exe windows:5 windows x86 arch:x86

d290bdfeb2cc5f9b421f3b7c8b0446de

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a
Signer

Actual PE Digest

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a

Digest Algorithm

sha256

PE Digest Matches

true

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08
Signer

Actual PE Digest

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventW
CreateFileMappingW
OpenMutexW
UnmapViewOfFile
MapViewOfFile
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
SetEvent
GetProcAddress
CreateFileW
WriteConsoleW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
RaiseException
RtlUnwind
GetCommandLineW
GetLastError
HeapFree
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
LoadLibraryExW
GetConsoleCP
OutputDebugStringW
FlushFileBuffers
SetStdHandle

user32

MessageBoxA

advapi32

RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
RegSetValueExW

Sections

.text
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

10a9sz8k
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

k4x0ku6i
Size: 285KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

92n.vcof
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
App/Uninstall Tool/UninstallTool_x64.dat
.exe windows:5 windows x64 arch:x64

d7511ed100c6dd5115c889f81ba7ab80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallTool.pdb

Imports

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathMatchSpecW
PathStripPathW
SHStrDupW
StrFormatByteSizeW
PathCompactPathW
ord487
PathParseIconLocationW
PathGetArgsW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsRelativeW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
FindResourceExW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
AreFileApisANSI
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlVirtualUnwind
UnhandledExceptionFilter
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
CreateFileW
CloseHandle
SetLastError
DeviceIoControl
SetEvent
ResetEvent
GetLocaleInfoW
CompareStringW
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
WaitForSingleObject
CreateEventW
TerminateThread
WaitForMultipleObjects
GetModuleHandleW
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
SuspendThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GlobalFree
QueryActCtxW
FindActCtxSectionStringW
FormatMessageA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
CreateDirectoryW
GetModuleHandleA
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetCurrentProcessId
VerifyVersionInfoW
GetUserDefaultUILanguage
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MulDiv
GetLastError
TerminateProcess
OpenProcess
lstrlenW
GetFileSize
ReadFile
GetCurrentProcess
GetSystemTime
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpynW
GetCurrentDirectoryW
Sleep
GetLocalTime
GetModuleFileNameW
lstrcatW
DeleteFileW
GetComputerNameW
SearchPathW
lstrcmpW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetSystemDefaultUILanguage
WinExec
GetTickCount
WriteFile
GetExitCodeThread
GetLongPathNameW
SetFilePointer
FileTimeToLocalFileTime
FileTimeToSystemTime
ResumeThread
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
OutputDebugStringA
GetACP
OutputDebugStringW
lstrcmpiW
GetFileAttributesExW
GetFileTime
LoadLibraryW
SystemTimeToFileTime
MoveFileExW
IsBadReadPtr
IsBadWritePtr
RemoveDirectoryW
SetFileAttributesW
LocalAlloc
LocalFree
FormatMessageW
CreateMutexW
OpenMutexW
lstrlenA
ExitProcess
LocalUnlock
LocalLock
GetVersionExW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
ExpandEnvironmentStringsW
VirtualProtect
GetNativeSystemInfo
GetVersion
SetUnhandledExceptionFilter
RtlCaptureContext
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThread
GetProcessTimes
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
lstrcpyW
GetCommandLineW
OpenEventW

user32

PostThreadMessageW
RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
IsIconic
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
CharNextW
GetWindowDC
ShowOwnedPopups
LoadMenuW
SendMessageW
EnableWindow
DestroyIcon
IsWindowVisible
GetNextDlgTabItem
EndDialog
IsWindowEnabled
SetDlgItemTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongPtrW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
ValidateRect
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
SetClassLongPtrW
SystemParametersInfoW
GetActiveWindow
GetWindowTextW
SetMenuDefaultItem
GetForegroundWindow
SetRectEmpty
IsRectEmpty
EqualRect
DefWindowProcW
GetClassInfoW
MessageBoxW
GetDesktopWindow
EnumWindows
GetDC
ReleaseDC
RegisterWindowMessageW
PostMessageW
IsWindow
GetFocus
GetKeyState
DrawTextW
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
SetRect
OffsetRect
PtInRect
GetParent
LoadCursorW
LoadImageW
DrawIconEx
GetIconInfo
GetSystemMetrics
GetWindowRect
SendMessageTimeoutW
GetWindowThreadProcessId
DrawFrameControl
GetMessagePos
SendDlgItemMessageA
WindowFromPoint
ShowScrollBar
GetUpdateRect
WinHelpW
IsDialogMessageW
GetLastActivePopup
SetWindowLongPtrW
GetWindowLongPtrW
MessageBeep
EndPaint
BeginPaint
DrawIcon
EnableMenuItem
GetSystemMenu
GetAsyncKeyState
GetDialogBaseUnits
CheckDlgButton
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
CreateIconIndirect
EnumDisplaySettingsW
FindWindowExW
FindWindowW
WaitForInputIdle
LoadStringW
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
ExitWindowsEx
GetMessageW
SetWindowLongW
GetWindowLongW
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AttachThreadInput
CharLowerBuffW
CreatePopupMenu
AppendMenuW
DrawTextExW
CharLowerBuffA
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DrawStateW
GetWindow
RedrawWindow
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateMDISysAccel
DefFrameProcW
DrawMenuBar
GetTabbedTextExtentA
SetWindowLongPtrA
GetWindowLongPtrA
IsWindowUnicode
GetClassLongW
SetCursorPos
GetDoubleClickTime
DrawEdge
LookupIconIdFromDirectoryEx
UnionRect
ShowCaret
HideCaret
GetWindowRgn
IsMenu
GetCursor
IsClipboardFormatAvailable
IsZoomed
MapVirtualKeyExW
GetKeyboardState
IsCharLowerW
GetKeyboardLayout
GetKeyboardLayoutList
DrawFocusRect
CopyRect
SetWindowPlacement
GetWindowPlacement
MoveWindow
FillRect
MapWindowPoints
SetWindowTextW
GetDlgItem
CharLowerW
LoadIconW
DeleteMenu
GetMenuItemCount
SetWindowPos
CopyIcon
GetClassNameW
KillTimer
SetTimer
SetForegroundWindow
GetMenuDefaultItem
TrackPopupMenu
UnregisterClassW
ClientToScreen
InsertMenuW
TabbedTextOutW
GrayStringW
CreateIconFromResourceEx
GetDCEx
LockWindowUpdate
InvertRect
wsprintfW
SetParent
SetWindowRgn
ToUnicodeEx
InflateRect

gdi32

GetDIBits
GetClipBox
CreateRectRgnIndirect
CreateBitmap
CreateDIBSection
DeleteDC
GetTextColor
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
Escape
BitBlt
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
MoveToEx
PolyBezierTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
PatBlt
ScaleWindowExtEx
GetMapMode
SetRectRgn
DPtoLP
GetTextMetricsW
GetRgnBox
EnumFontFamiliesExW
RestoreDC
RealizePalette
SaveDC
ExtSelectClipRgn
SetBkColor
SetBkMode
SetDIBitsToDevice
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
CreateDCW
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetPixel
CreatePatternBrush
ExcludeClipRect
GetClipRgn
GetCurrentPositionEx
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
SelectClipRgn
SetMapMode
SetTextAlign
SetPixel
Polygon
GetCurrentObject
ExtCreateRegion
PtInRegion
GetViewportOrgEx
CreateFontW
Polyline
Ellipse
GetCharWidthW
GetTextAlign
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
CreatePolygonRgn
GetWindowOrgEx
SetPixelV
FillRgn
FrameRgn
ScaleViewportExtEx
GetBitmapBits

msimg32

AlphaBlend
GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

GetTokenInformation
RegOpenKeyExW
RegCreateKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
CloseServiceHandle
ControlService
EnumServicesStatusExW
OpenSCManagerW
OpenServiceW
RegQueryValueW
RegEnumKeyW
RegEnumValueW
ConvertSidToStringSidW
LookupPrivilegeValueW
IsValidSid
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceConfigW

shell32

ShellExecuteExW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFileInfoW
CommandLineToArgvW
SHGetPathFromIDListW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetIconSize

uxtheme

DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeTypeEx
VarUdateFromDate
OleLoadPicturePath
VarBstrFromDate
SysAllocString
SysAllocStringLen
SysFreeString
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
VarDateFromStr

oledlg

OleUIBusyW
OleUIAddVerbMenuW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetSetOptionExW
InternetQueryOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW

winmm

PlaySoundW

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
App/Uninstall Tool/UninstallTool_x86.dat
.exe windows:5 windows x86 arch:x86

28a35fedcf5f81c805d6cebcea3e68ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallTool-x86.pdb

Imports

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathMatchSpecW
PathStripPathW
SHStrDupW
StrFormatByteSizeW
PathCompactPathW
ord487
PathParseIconLocationW
PathGetArgsW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsRelativeW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW

kernel32

ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleExW
AreFileApisANSI
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
CreateFileW
CloseHandle
SetLastError
DeviceIoControl
SetEvent
ResetEvent
RtlUnwind
FindResourceExW
SetErrorMode
GetFileSizeEx
GetFileAttributesW
WaitForSingleObject
CreateEventW
TerminateThread
WaitForMultipleObjects
GetModuleHandleW
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
SuspendThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
FormatMessageA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetCurrentProcess
GetCurrentProcessId
VerifyVersionInfoW
GetUserDefaultUILanguage
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MulDiv
GetLastError
TerminateProcess
OpenProcess
lstrlenW
FileTimeToLocalFileTime
GetFileSize
ReadFile
GetSystemTime
GetSystemTimeAsFileTime
GetProcAddress
FileTimeToDosDateTime
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
LoadLibraryA
lstrcpynW
GetCurrentDirectoryW
Sleep
GetLocalTime
GetModuleFileNameW
lstrcatW
DeleteFileW
GetComputerNameW
SearchPathW
lstrcmpW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
WinExec
GetTickCount
WriteFile
GetExitCodeThread
CreateThread
GetLongPathNameW
SetFilePointer
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GlobalFree
GetModuleHandleA
FileTimeToSystemTime
ResumeThread
lstrcmpiW
GetFileAttributesExW
GetFileTime
SystemTimeToFileTime
MoveFileExW
IsBadReadPtr
IsBadWritePtr
RemoveDirectoryW
SetFileAttributesW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageW
OutputDebugStringA
GetACP
OutputDebugStringW
lstrlenA
ExitProcess
LocalUnlock
LocalLock
GetVersionExW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
ExpandEnvironmentStringsW
VirtualProtect
GetNativeSystemInfo
GetVersion
SetUnhandledExceptionFilter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThread
GetProcessTimes
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
lstrcpyW
OpenEventW
OpenMutexW
CreateMutexW
GetCommandLineW

user32

PostThreadMessageW
RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
IsIconic
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
SendMessageW
EnableWindow
DestroyIcon
IsWindowVisible
GetKeyNameTextW
IntersectRect
CharNextW
GetWindowDC
ShowOwnedPopups
LoadMenuW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
SetDlgItemTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
ValidateRect
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetMenuItemID
GetSubMenu
GetMenuState
InflateRect
SetClassLongW
GetActiveWindow
GetWindowTextW
SystemParametersInfoW
SetMenuDefaultItem
GetForegroundWindow
SetRectEmpty
IsRectEmpty
EqualRect
DefWindowProcW
MessageBoxW
GetDesktopWindow
EnumWindows
GetDC
ReleaseDC
RegisterWindowMessageW
PostMessageW
IsWindow
GetFocus
GetKeyState
DrawTextW
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
SetRect
OffsetRect
PtInRect
GetParent
LoadCursorW
LoadImageW
DrawIconEx
GetIconInfo
GetSystemMetrics
GetWindowRect
SendMessageTimeoutW
GetWindowThreadProcessId
MessageBoxA
DrawFrameControl
GetMenuStringW
SendDlgItemMessageA
WindowFromPoint
ShowScrollBar
GetUpdateRect
WinHelpW
IsDialogMessageW
GetLastActivePopup
MessageBeep
EndPaint
BeginPaint
DrawIcon
EnableMenuItem
GetSystemMenu
GetAsyncKeyState
GetDialogBaseUnits
CheckDlgButton
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
CreateIconIndirect
EnumDisplaySettingsW
FindWindowExW
FindWindowW
WaitForInputIdle
LoadStringW
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
ExitWindowsEx
GetMessageW
SetWindowLongW
GetWindowLongW
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AttachThreadInput
CharLowerBuffW
GetMessagePos
CreatePopupMenu
GetClassInfoW
CharLowerBuffA
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DrawStateW
GetWindow
RedrawWindow
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateMDISysAccel
DefFrameProcW
DrawMenuBar
GetTabbedTextExtentA
SetWindowLongA
GetWindowLongA
IsWindowUnicode
SetCursorPos
GetDoubleClickTime
DrawEdge
LookupIconIdFromDirectoryEx
UnionRect
ShowCaret
HideCaret
GetWindowRgn
IsMenu
GetCursor
IsClipboardFormatAvailable
IsZoomed
MapVirtualKeyExW
GetKeyboardState
IsCharLowerW
GetKeyboardLayout
GetKeyboardLayoutList
ToUnicodeEx
SetWindowRgn
AppendMenuW
DrawFocusRect
SetWindowPlacement
GetWindowPlacement
MoveWindow
FillRect
MapWindowPoints
SetWindowTextW
GetDlgItem
CharLowerW
LoadIconW
DeleteMenu
GetMenuItemCount
SetWindowPos
CopyIcon
GetClassNameW
KillTimer
SetTimer
SetForegroundWindow
GetMenuDefaultItem
TrackPopupMenu
UnregisterClassW
ClientToScreen
InsertMenuW
TabbedTextOutW
GrayStringW
DrawTextExW
CreateIconFromResourceEx
GetDCEx
LockWindowUpdate
InvertRect
wsprintfW
SetParent
CopyRect

gdi32

RealizePalette
RestoreDC
GetDIBits
GetClipBox
CreateRectRgnIndirect
CreateBitmap
GetBitmapBits
CreateDIBSection
DeleteDC
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
Escape
BitBlt
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextColor
SaveDC
SetRectRgn
DPtoLP
GetTextMetricsW
GetRgnBox
EnumFontFamiliesExW
ExtSelectClipRgn
SetBkColor
SetBkMode
SetDIBitsToDevice
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
CreateDCW
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetPixel
CreatePatternBrush
ExcludeClipRect
GetClipRgn
GetCurrentPositionEx
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
SelectClipRgn
SetMapMode
SetTextAlign
SetPixel
Polygon
GetCurrentObject
ExtCreateRegion
PtInRegion
GetViewportOrgEx
CreateFontW
Polyline
Ellipse
GetCharWidthW
GetTextAlign
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
CreatePolygonRgn
GetWindowOrgEx
SetPixelV
FillRgn
FrameRgn
MoveToEx
PolyBezierTo
GetMapMode
PatBlt
SetViewportExtEx

msimg32

AlphaBlend
GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegCreateKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegQueryInfoKeyW
CloseServiceHandle
RegQueryValueW
RegEnumKeyW
RegEnumValueW
ConvertSidToStringSidW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
ControlService

shell32

ShellExecuteExW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFileInfoW
CommandLineToArgvW
SHGetPathFromIDListW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetIconSize

uxtheme

DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeTypeEx
VarUdateFromDate
OleLoadPicturePath
VarBstrFromDate
SysAllocString
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
VarDateFromStr

oledlg

OleUIBusyW
OleUIAddVerbMenuW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetSetOptionExW
InternetQueryOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW

winmm

PlaySoundW

Exports

Exports

_EXECryptor_AntiDebug@0
_EXECryptor_DecodeSerialNumber@16
_EXECryptor_DecodeSerialNumberW@16
_EXECryptor_DecryptStr@8
_EXECryptor_DecryptStrW@8
_EXECryptor_EncryptStr@8
_EXECryptor_EncryptStrW@8
_EXECryptor_GetDate@0
_EXECryptor_GetEXECryptorVersion@0
_EXECryptor_GetHardwareID@0
_EXECryptor_GetProcAddr@8
_EXECryptor_GetReleaseDate@0
_EXECryptor_GetTrialDaysLeft@4
_EXECryptor_GetTrialRunsLeft@4
_EXECryptor_IsAppProtected@0
_EXECryptor_IsRegistered@0
_EXECryptor_MessageBoxA@16
_EXECryptor_ProtectImport@0
_EXECryptor_RegConst_0@0
_EXECryptor_RegConst_1@0
_EXECryptor_RegConst_2@0
_EXECryptor_RegConst_3@0
_EXECryptor_RegConst_4@0
_EXECryptor_RegConst_5@0
_EXECryptor_RegConst_6@0
_EXECryptor_RegConst_7@0
_EXECryptor_SecureRead@8
_EXECryptor_SecureReadW@8
_EXECryptor_SecureWrite@8
_EXECryptor_SecureWriteW@8
_EXECryptor_VerifySerialNumber@16
_EXECryptor_VerifySerialNumberW@16

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 603KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
App/Uninstall Tool/languages/Arabic.xml
App/Uninstall Tool/languages/Armenian.xml
App/Uninstall Tool/languages/Azerbaijani.xml
App/Uninstall Tool/languages/Belarusian.xml
App/Uninstall Tool/languages/Bulgarian.xml
App/Uninstall Tool/languages/Chinese_Simplified.xml
App/Uninstall Tool/languages/Chinese_Traditional.xml
App/Uninstall Tool/languages/Croatian.xml
App/Uninstall Tool/languages/Czech.xml
App/Uninstall Tool/languages/Danish.xml
App/Uninstall Tool/languages/Dutch.xml
App/Uninstall Tool/languages/English.xml
App/Uninstall Tool/languages/Estonian.xml
App/Uninstall Tool/languages/French.xml
App/Uninstall Tool/languages/Georgian.xml
App/Uninstall Tool/languages/German.xml
App/Uninstall Tool/languages/Greek.xml
App/Uninstall Tool/languages/Hebrew.xml
App/Uninstall Tool/languages/Hindi.xml
App/Uninstall Tool/languages/Hungarian.xml
App/Uninstall Tool/languages/Indonesian.xml
App/Uninstall Tool/languages/Italian.xml
App/Uninstall Tool/languages/Japanese.xml
App/Uninstall Tool/languages/Korean.xml
App/Uninstall Tool/languages/Latvian.xml
App/Uninstall Tool/languages/Lithuanian.xml
App/Uninstall Tool/languages/Norwegian.xml
App/Uninstall Tool/languages/Persian.xml
App/Uninstall Tool/languages/Polish.xml
App/Uninstall Tool/languages/Portuguese.xml
App/Uninstall Tool/languages/Portuguese_Brazilian.xml
App/Uninstall Tool/languages/Romanian.xml
App/Uninstall Tool/languages/Russian.xml
App/Uninstall Tool/languages/Serbian_Cyrillic.xml
App/Uninstall Tool/languages/Serbian_Latin.xml
App/Uninstall Tool/languages/Slovak.xml
App/Uninstall Tool/languages/Spanish.xml
App/Uninstall Tool/languages/Swedish.xml
App/Uninstall Tool/languages/Turkish.xml
App/Uninstall Tool/languages/Ukrainian.xml
App/Uninstall Tool/languages/Vietnamese.xml
App/Uninstall Tool/license.dat
App/Uninstall Tool/x64/CisUtMonitor.inf
App/Uninstall Tool/x64/CisUtMonitor.sys
.sys windows:6 windows x64 arch:x64

f43b6ef93625d306e6fdaf0ae00f11b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\_prog\exlade\cidriver\driver\cisutmonitor\obj_release\amd64\CisUtMonitor.pdb

Imports

ntoskrnl.exe

ExDeletePagedLookasideList
IoUnregisterShutdownNotification
ExEventObjectType
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
PsGetVersion
ExInterlockedRemoveHeadList
CmRegisterCallback
IoCreateSymbolicLink
ExInitializePagedLookasideList
ObfDereferenceObject
IoCreateDevice
CmUnRegisterCallback
DbgPrint
ExDeleteNPagedLookasideList
IoThreadToProcess
KeSetEvent
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
PsGetProcessId
KeReleaseMutex
ExAllocatePoolWithTag
_wcsnicmp
RtlCheckRegistryKey
ZwQueryValueKey
RtlCompareUnicodeString
RtlConvertSidToUnicodeString
ZwOpenThreadTokenEx
RtlTimeToSecondsSince1970
MmGetSystemRoutineAddress
ZwOpenProcessTokenEx
ObQueryNameString
ExSystemTimeToLocalTime
ZwClose
ZwOpenProcess
RtlCopyUnicodeString
MmIsAddressValid
ZwQueryInformationToken
ZwOpenKey
KeBugCheckEx
PsSetCreateProcessNotifyRoutine
ExpInterlockedPushEntrySList
IoDeleteDevice
RtlInitUnicodeString
ExInitializeNPagedLookasideList
KeInitializeMutex
IoRegisterShutdownNotification
ExFreePoolWithTag
_wcsicmp
IoDeleteSymbolicLink
__C_specific_handler

fltmgr.sys

FltReleaseFileNameInformation
FltCloseCommunicationPort
FltGetFileNameInformation
FltGetDestinationFileNameInformation
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltParseFileNameInformation

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
App/Uninstall Tool/x64/UninstallTool.cpl
.dll windows:5 windows x64 arch:x64

9c93178cd8afc64354965ebaf62e32da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d
Signer

Actual PE Digest

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d

Digest Algorithm

sha256

PE Digest Matches

true

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2
Signer

Actual PE Digest

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
CloseHandle
lstrcpyW
lstrcatW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetVersionExW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
CreateFileW

user32

LoadIconW
LoadStringW

shell32

ShellExecuteW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW

Exports

Exports

CPlApplet

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
App/Uninstall Tool/x64/UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
App/Uninstall Tool/x64/utshellext.dll
.dll regsvr32 windows:5 windows x64 arch:x64

99a462a3c8c3959a8c3fd90e70a36a53

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4
Signer

Actual PE Digest

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4

Digest Algorithm

sha256

PE Digest Matches

true

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45
Signer

Actual PE Digest

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x64\utshellext.pdb

Imports

kernel32

GetProcessHeap
FreeLibrary
ExpandEnvironmentStringsW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineA
GetCurrentThreadId
ReadFile
HeapReAlloc
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LoadLibraryExW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetModuleHandleA
FormatMessageA
HeapAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
LoadLibraryW
lstrlenW
LocalFree
GetProcAddress
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetModuleHandleW
GetLastError

user32

DrawIconEx
LoadImageW
GetParent
InsertMenuItemW
InsertMenuW
DestroyIcon
CreateIconIndirect
GetSystemMetrics
GetDC
ReleaseDC
MessageBoxW
GetActiveWindow
SetRect
GetIconInfo
GetMenuItemCount

gdi32

CreateDIBSection
SelectObject
GetDIBits
DeleteObject
CreateCompatibleDC
RealizePalette
GetObjectW
GetDeviceCaps
DeleteDC

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

shell32

SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW

ole32

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
App/Uninstall Tool/x86/CisUtMonitor.inf
App/Uninstall Tool/x86/UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CisUtMonitor.inf
CisUtMonitor.sys
.sys windows:6 windows x64 arch:x64

f43b6ef93625d306e6fdaf0ae00f11b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\_prog\exlade\cidriver\driver\cisutmonitor\obj_release\amd64\CisUtMonitor.pdb

Imports

ntoskrnl.exe

ExDeletePagedLookasideList
IoUnregisterShutdownNotification
ExEventObjectType
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
PsGetVersion
ExInterlockedRemoveHeadList
CmRegisterCallback
IoCreateSymbolicLink
ExInitializePagedLookasideList
ObfDereferenceObject
IoCreateDevice
CmUnRegisterCallback
DbgPrint
ExDeleteNPagedLookasideList
IoThreadToProcess
KeSetEvent
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
PsGetProcessId
KeReleaseMutex
ExAllocatePoolWithTag
_wcsnicmp
RtlCheckRegistryKey
ZwQueryValueKey
RtlCompareUnicodeString
RtlConvertSidToUnicodeString
ZwOpenThreadTokenEx
RtlTimeToSecondsSince1970
MmGetSystemRoutineAddress
ZwOpenProcessTokenEx
ObQueryNameString
ExSystemTimeToLocalTime
ZwClose
ZwOpenProcess
RtlCopyUnicodeString
MmIsAddressValid
ZwQueryInformationToken
ZwOpenKey
KeBugCheckEx
PsSetCreateProcessNotifyRoutine
ExpInterlockedPushEntrySList
IoDeleteDevice
RtlInitUnicodeString
ExInitializeNPagedLookasideList
KeInitializeMutex
IoRegisterShutdownNotification
ExFreePoolWithTag
_wcsicmp
IoDeleteSymbolicLink
__C_specific_handler

fltmgr.sys

FltReleaseFileNameInformation
FltCloseCommunicationPort
FltGetFileNameInformation
FltGetDestinationFileNameInformation
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltParseFileNameInformation

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RemoveService.cmd
UninstallTool.cpl
.dll windows:5 windows x64 arch:x64

9c93178cd8afc64354965ebaf62e32da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d
Signer

Actual PE Digest

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d

Digest Algorithm

sha256

PE Digest Matches

true

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2
Signer

Actual PE Digest

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
CloseHandle
lstrcpyW
lstrcatW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetVersionExW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
CreateFileW

user32

LoadIconW
LoadStringW

shell32

ShellExecuteW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW

Exports

Exports

CPlApplet

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UninstallTool.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UninstallToolHelper.exe
.exe windows:5 windows x86 arch:x86

d290bdfeb2cc5f9b421f3b7c8b0446de

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a
Signer

Actual PE Digest

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a

Digest Algorithm

sha256

PE Digest Matches

true

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08
Signer

Actual PE Digest

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventW
CreateFileMappingW
OpenMutexW
UnmapViewOfFile
MapViewOfFile
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
SetEvent
GetProcAddress
CreateFileW
WriteConsoleW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
RaiseException
RtlUnwind
GetCommandLineW
GetLastError
HeapFree
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
LoadLibraryExW
GetConsoleCP
OutputDebugStringW
FlushFileBuffers
SetStdHandle

user32

MessageBoxA

advapi32

RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
RegSetValueExW

Sections

.text
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

10a9sz8k
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

k4x0ku6i
Size: 285KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

92n.vcof
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
UninstallTool_x64.dat
.exe windows:5 windows x64 arch:x64

d7511ed100c6dd5115c889f81ba7ab80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallTool.pdb

Imports

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathMatchSpecW
PathStripPathW
SHStrDupW
StrFormatByteSizeW
PathCompactPathW
ord487
PathParseIconLocationW
PathGetArgsW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsRelativeW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
FindResourceExW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
AreFileApisANSI
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlVirtualUnwind
UnhandledExceptionFilter
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
CreateFileW
CloseHandle
SetLastError
DeviceIoControl
SetEvent
ResetEvent
GetLocaleInfoW
CompareStringW
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
WaitForSingleObject
CreateEventW
TerminateThread
WaitForMultipleObjects
GetModuleHandleW
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
SuspendThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GlobalFree
QueryActCtxW
FindActCtxSectionStringW
FormatMessageA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
CreateDirectoryW
GetModuleHandleA
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetCurrentProcessId
VerifyVersionInfoW
GetUserDefaultUILanguage
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MulDiv
GetLastError
TerminateProcess
OpenProcess
lstrlenW
GetFileSize
ReadFile
GetCurrentProcess
GetSystemTime
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpynW
GetCurrentDirectoryW
Sleep
GetLocalTime
GetModuleFileNameW
lstrcatW
DeleteFileW
GetComputerNameW
SearchPathW
lstrcmpW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetSystemDefaultUILanguage
WinExec
GetTickCount
WriteFile
GetExitCodeThread
GetLongPathNameW
SetFilePointer
FileTimeToLocalFileTime
FileTimeToSystemTime
ResumeThread
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
OutputDebugStringA
GetACP
OutputDebugStringW
lstrcmpiW
GetFileAttributesExW
GetFileTime
LoadLibraryW
SystemTimeToFileTime
MoveFileExW
IsBadReadPtr
IsBadWritePtr
RemoveDirectoryW
SetFileAttributesW
LocalAlloc
LocalFree
FormatMessageW
CreateMutexW
OpenMutexW
lstrlenA
ExitProcess
LocalUnlock
LocalLock
GetVersionExW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
ExpandEnvironmentStringsW
VirtualProtect
GetNativeSystemInfo
GetVersion
SetUnhandledExceptionFilter
RtlCaptureContext
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThread
GetProcessTimes
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
lstrcpyW
GetCommandLineW
OpenEventW

user32

PostThreadMessageW
RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
IsIconic
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
CharNextW
GetWindowDC
ShowOwnedPopups
LoadMenuW
SendMessageW
EnableWindow
DestroyIcon
IsWindowVisible
GetNextDlgTabItem
EndDialog
IsWindowEnabled
SetDlgItemTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongPtrW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
ValidateRect
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
SetClassLongPtrW
SystemParametersInfoW
GetActiveWindow
GetWindowTextW
SetMenuDefaultItem
GetForegroundWindow
SetRectEmpty
IsRectEmpty
EqualRect
DefWindowProcW
GetClassInfoW
MessageBoxW
GetDesktopWindow
EnumWindows
GetDC
ReleaseDC
RegisterWindowMessageW
PostMessageW
IsWindow
GetFocus
GetKeyState
DrawTextW
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
SetRect
OffsetRect
PtInRect
GetParent
LoadCursorW
LoadImageW
DrawIconEx
GetIconInfo
GetSystemMetrics
GetWindowRect
SendMessageTimeoutW
GetWindowThreadProcessId
DrawFrameControl
GetMessagePos
SendDlgItemMessageA
WindowFromPoint
ShowScrollBar
GetUpdateRect
WinHelpW
IsDialogMessageW
GetLastActivePopup
SetWindowLongPtrW
GetWindowLongPtrW
MessageBeep
EndPaint
BeginPaint
DrawIcon
EnableMenuItem
GetSystemMenu
GetAsyncKeyState
GetDialogBaseUnits
CheckDlgButton
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
CreateIconIndirect
EnumDisplaySettingsW
FindWindowExW
FindWindowW
WaitForInputIdle
LoadStringW
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
ExitWindowsEx
GetMessageW
SetWindowLongW
GetWindowLongW
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AttachThreadInput
CharLowerBuffW
CreatePopupMenu
AppendMenuW
DrawTextExW
CharLowerBuffA
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DrawStateW
GetWindow
RedrawWindow
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateMDISysAccel
DefFrameProcW
DrawMenuBar
GetTabbedTextExtentA
SetWindowLongPtrA
GetWindowLongPtrA
IsWindowUnicode
GetClassLongW
SetCursorPos
GetDoubleClickTime
DrawEdge
LookupIconIdFromDirectoryEx
UnionRect
ShowCaret
HideCaret
GetWindowRgn
IsMenu
GetCursor
IsClipboardFormatAvailable
IsZoomed
MapVirtualKeyExW
GetKeyboardState
IsCharLowerW
GetKeyboardLayout
GetKeyboardLayoutList
DrawFocusRect
CopyRect
SetWindowPlacement
GetWindowPlacement
MoveWindow
FillRect
MapWindowPoints
SetWindowTextW
GetDlgItem
CharLowerW
LoadIconW
DeleteMenu
GetMenuItemCount
SetWindowPos
CopyIcon
GetClassNameW
KillTimer
SetTimer
SetForegroundWindow
GetMenuDefaultItem
TrackPopupMenu
UnregisterClassW
ClientToScreen
InsertMenuW
TabbedTextOutW
GrayStringW
CreateIconFromResourceEx
GetDCEx
LockWindowUpdate
InvertRect
wsprintfW
SetParent
SetWindowRgn
ToUnicodeEx
InflateRect

gdi32

GetDIBits
GetClipBox
CreateRectRgnIndirect
CreateBitmap
CreateDIBSection
DeleteDC
GetTextColor
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
Escape
BitBlt
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
MoveToEx
PolyBezierTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
PatBlt
ScaleWindowExtEx
GetMapMode
SetRectRgn
DPtoLP
GetTextMetricsW
GetRgnBox
EnumFontFamiliesExW
RestoreDC
RealizePalette
SaveDC
ExtSelectClipRgn
SetBkColor
SetBkMode
SetDIBitsToDevice
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
CreateDCW
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetPixel
CreatePatternBrush
ExcludeClipRect
GetClipRgn
GetCurrentPositionEx
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
SelectClipRgn
SetMapMode
SetTextAlign
SetPixel
Polygon
GetCurrentObject
ExtCreateRegion
PtInRegion
GetViewportOrgEx
CreateFontW
Polyline
Ellipse
GetCharWidthW
GetTextAlign
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
CreatePolygonRgn
GetWindowOrgEx
SetPixelV
FillRgn
FrameRgn
ScaleViewportExtEx
GetBitmapBits

msimg32

AlphaBlend
GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

GetTokenInformation
RegOpenKeyExW
RegCreateKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
CloseServiceHandle
ControlService
EnumServicesStatusExW
OpenSCManagerW
OpenServiceW
RegQueryValueW
RegEnumKeyW
RegEnumValueW
ConvertSidToStringSidW
LookupPrivilegeValueW
IsValidSid
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceConfigW

shell32

ShellExecuteExW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFileInfoW
CommandLineToArgvW
SHGetPathFromIDListW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetIconSize

uxtheme

DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeTypeEx
VarUdateFromDate
OleLoadPicturePath
VarBstrFromDate
SysAllocString
SysAllocStringLen
SysFreeString
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
VarDateFromStr

oledlg

OleUIBusyW
OleUIAddVerbMenuW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetSetOptionExW
InternetQueryOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW

winmm

PlaySoundW

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UninstallTool_x86.dat
.exe windows:5 windows x86 arch:x86

28a35fedcf5f81c805d6cebcea3e68ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallTool-x86.pdb

Imports

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathMatchSpecW
PathStripPathW
SHStrDupW
StrFormatByteSizeW
PathCompactPathW
ord487
PathParseIconLocationW
PathGetArgsW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsRelativeW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW

kernel32

ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleExW
AreFileApisANSI
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
CreateFileW
CloseHandle
SetLastError
DeviceIoControl
SetEvent
ResetEvent
RtlUnwind
FindResourceExW
SetErrorMode
GetFileSizeEx
GetFileAttributesW
WaitForSingleObject
CreateEventW
TerminateThread
WaitForMultipleObjects
GetModuleHandleW
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
SuspendThread
SetThreadPriority
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
FormatMessageA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetCurrentProcess
GetCurrentProcessId
VerifyVersionInfoW
GetUserDefaultUILanguage
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MulDiv
GetLastError
TerminateProcess
OpenProcess
lstrlenW
FileTimeToLocalFileTime
GetFileSize
ReadFile
GetSystemTime
GetSystemTimeAsFileTime
GetProcAddress
FileTimeToDosDateTime
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
LoadLibraryA
lstrcpynW
GetCurrentDirectoryW
Sleep
GetLocalTime
GetModuleFileNameW
lstrcatW
DeleteFileW
GetComputerNameW
SearchPathW
lstrcmpW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
WinExec
GetTickCount
WriteFile
GetExitCodeThread
CreateThread
GetLongPathNameW
SetFilePointer
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GlobalFree
GetModuleHandleA
FileTimeToSystemTime
ResumeThread
lstrcmpiW
GetFileAttributesExW
GetFileTime
SystemTimeToFileTime
MoveFileExW
IsBadReadPtr
IsBadWritePtr
RemoveDirectoryW
SetFileAttributesW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageW
OutputDebugStringA
GetACP
OutputDebugStringW
lstrlenA
ExitProcess
LocalUnlock
LocalLock
GetVersionExW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
ExpandEnvironmentStringsW
VirtualProtect
GetNativeSystemInfo
GetVersion
SetUnhandledExceptionFilter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThread
GetProcessTimes
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
lstrcpyW
OpenEventW
OpenMutexW
CreateMutexW
GetCommandLineW

user32

PostThreadMessageW
RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
IsIconic
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
SendMessageW
EnableWindow
DestroyIcon
IsWindowVisible
GetKeyNameTextW
IntersectRect
CharNextW
GetWindowDC
ShowOwnedPopups
LoadMenuW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
SetDlgItemTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
ValidateRect
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetMenuItemID
GetSubMenu
GetMenuState
InflateRect
SetClassLongW
GetActiveWindow
GetWindowTextW
SystemParametersInfoW
SetMenuDefaultItem
GetForegroundWindow
SetRectEmpty
IsRectEmpty
EqualRect
DefWindowProcW
MessageBoxW
GetDesktopWindow
EnumWindows
GetDC
ReleaseDC
RegisterWindowMessageW
PostMessageW
IsWindow
GetFocus
GetKeyState
DrawTextW
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ScreenToClient
GetSysColor
SetRect
OffsetRect
PtInRect
GetParent
LoadCursorW
LoadImageW
DrawIconEx
GetIconInfo
GetSystemMetrics
GetWindowRect
SendMessageTimeoutW
GetWindowThreadProcessId
MessageBoxA
DrawFrameControl
GetMenuStringW
SendDlgItemMessageA
WindowFromPoint
ShowScrollBar
GetUpdateRect
WinHelpW
IsDialogMessageW
GetLastActivePopup
MessageBeep
EndPaint
BeginPaint
DrawIcon
EnableMenuItem
GetSystemMenu
GetAsyncKeyState
GetDialogBaseUnits
CheckDlgButton
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
WaitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
CreateIconIndirect
EnumDisplaySettingsW
FindWindowExW
FindWindowW
WaitForInputIdle
LoadStringW
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
ExitWindowsEx
GetMessageW
SetWindowLongW
GetWindowLongW
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AttachThreadInput
CharLowerBuffW
GetMessagePos
CreatePopupMenu
GetClassInfoW
CharLowerBuffA
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DrawStateW
GetWindow
RedrawWindow
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateMDISysAccel
DefFrameProcW
DrawMenuBar
GetTabbedTextExtentA
SetWindowLongA
GetWindowLongA
IsWindowUnicode
SetCursorPos
GetDoubleClickTime
DrawEdge
LookupIconIdFromDirectoryEx
UnionRect
ShowCaret
HideCaret
GetWindowRgn
IsMenu
GetCursor
IsClipboardFormatAvailable
IsZoomed
MapVirtualKeyExW
GetKeyboardState
IsCharLowerW
GetKeyboardLayout
GetKeyboardLayoutList
ToUnicodeEx
SetWindowRgn
AppendMenuW
DrawFocusRect
SetWindowPlacement
GetWindowPlacement
MoveWindow
FillRect
MapWindowPoints
SetWindowTextW
GetDlgItem
CharLowerW
LoadIconW
DeleteMenu
GetMenuItemCount
SetWindowPos
CopyIcon
GetClassNameW
KillTimer
SetTimer
SetForegroundWindow
GetMenuDefaultItem
TrackPopupMenu
UnregisterClassW
ClientToScreen
InsertMenuW
TabbedTextOutW
GrayStringW
DrawTextExW
CreateIconFromResourceEx
GetDCEx
LockWindowUpdate
InvertRect
wsprintfW
SetParent
CopyRect

gdi32

RealizePalette
RestoreDC
GetDIBits
GetClipBox
CreateRectRgnIndirect
CreateBitmap
GetBitmapBits
CreateDIBSection
DeleteDC
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
Escape
BitBlt
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextColor
SaveDC
SetRectRgn
DPtoLP
GetTextMetricsW
GetRgnBox
EnumFontFamiliesExW
ExtSelectClipRgn
SetBkColor
SetBkMode
SetDIBitsToDevice
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
CreateDCW
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetPixel
CreatePatternBrush
ExcludeClipRect
GetClipRgn
GetCurrentPositionEx
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
SelectClipRgn
SetMapMode
SetTextAlign
SetPixel
Polygon
GetCurrentObject
ExtCreateRegion
PtInRegion
GetViewportOrgEx
CreateFontW
Polyline
Ellipse
GetCharWidthW
GetTextAlign
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
CreatePolygonRgn
GetWindowOrgEx
SetPixelV
FillRgn
FrameRgn
MoveToEx
PolyBezierTo
GetMapMode
PatBlt
SetViewportExtEx

msimg32

AlphaBlend
GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegCreateKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegQueryInfoKeyW
CloseServiceHandle
RegQueryValueW
RegEnumKeyW
RegEnumValueW
ConvertSidToStringSidW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
ControlService

shell32

ShellExecuteExW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFileInfoW
CommandLineToArgvW
SHGetPathFromIDListW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetIconSize

uxtheme

DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeTypeEx
VarUdateFromDate
OleLoadPicturePath
VarBstrFromDate
SysAllocString
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
VarDateFromStr

oledlg

OleUIBusyW
OleUIAddVerbMenuW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetSetOptionExW
InternetQueryOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW

winmm

PlaySoundW

Exports

Exports

_EXECryptor_AntiDebug@0
_EXECryptor_DecodeSerialNumber@16
_EXECryptor_DecodeSerialNumberW@16
_EXECryptor_DecryptStr@8
_EXECryptor_DecryptStrW@8
_EXECryptor_EncryptStr@8
_EXECryptor_EncryptStrW@8
_EXECryptor_GetDate@0
_EXECryptor_GetEXECryptorVersion@0
_EXECryptor_GetHardwareID@0
_EXECryptor_GetProcAddr@8
_EXECryptor_GetReleaseDate@0
_EXECryptor_GetTrialDaysLeft@4
_EXECryptor_GetTrialRunsLeft@4
_EXECryptor_IsAppProtected@0
_EXECryptor_IsRegistered@0
_EXECryptor_MessageBoxA@16
_EXECryptor_ProtectImport@0
_EXECryptor_RegConst_0@0
_EXECryptor_RegConst_1@0
_EXECryptor_RegConst_2@0
_EXECryptor_RegConst_3@0
_EXECryptor_RegConst_4@0
_EXECryptor_RegConst_5@0
_EXECryptor_RegConst_6@0
_EXECryptor_RegConst_7@0
_EXECryptor_SecureRead@8
_EXECryptor_SecureReadW@8
_EXECryptor_SecureWrite@8
_EXECryptor_SecureWriteW@8
_EXECryptor_VerifySerialNumber@16
_EXECryptor_VerifySerialNumberW@16

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 603KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
languages/Arabic.xml
languages/Armenian.xml
languages/Azerbaijani.xml
languages/Belarusian.xml
languages/Bulgarian.xml
languages/Chinese_Simplified.xml
languages/Chinese_Traditional.xml
languages/Croatian.xml
languages/Czech.xml
languages/Danish.xml
languages/Dutch.xml
languages/English.xml
languages/Estonian.xml
languages/French.xml
languages/Georgian.xml
languages/German.xml
languages/Greek.xml
languages/Hebrew.xml
languages/Hindi.xml
languages/Hungarian.xml
languages/Indonesian.xml
languages/Italian.xml
languages/Japanese.xml
languages/Korean.xml
languages/Latvian.xml
languages/Lithuanian.xml
languages/Norwegian.xml
languages/Persian.xml
languages/Polish.xml
languages/Portuguese.xml
languages/Portuguese_Brazilian.xml
languages/Romanian.xml
languages/Russian.xml
languages/Serbian_Cyrillic.xml
languages/Serbian_Latin.xml
languages/Slovak.xml
languages/Spanish.xml
languages/Swedish.xml
languages/Turkish.xml
languages/Ukrainian.xml
languages/Vietnamese.xml
license.dat
utshellext.dll
.dll regsvr32 windows:5 windows x64 arch:x64

99a462a3c8c3959a8c3fd90e70a36a53

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4
Signer

Actual PE Digest

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4

Digest Algorithm

sha256

PE Digest Matches

true

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45
Signer

Actual PE Digest

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x64\utshellext.pdb

Imports

kernel32

GetProcessHeap
FreeLibrary
ExpandEnvironmentStringsW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineA
GetCurrentThreadId
ReadFile
HeapReAlloc
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LoadLibraryExW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetModuleHandleA
FormatMessageA
HeapAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
LoadLibraryW
lstrlenW
LocalFree
GetProcAddress
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetModuleHandleW
GetLastError

user32

DrawIconEx
LoadImageW
GetParent
InsertMenuItemW
InsertMenuW
DestroyIcon
CreateIconIndirect
GetSystemMetrics
GetDC
ReleaseDC
MessageBoxW
GetActiveWindow
SetRect
GetIconInfo
GetMenuItemCount

gdi32

CreateDIBSection
SelectObject
GetDIBits
DeleteObject
CreateCompatibleDC
RealizePalette
GetObjectW
GetDeviceCaps
DeleteDC

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

shell32

SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW

ole32

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/CisUtMonitor.inf
x64/CisUtMonitor.sys
.sys windows:6 windows x64 arch:x64

f43b6ef93625d306e6fdaf0ae00f11b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\_prog\exlade\cidriver\driver\cisutmonitor\obj_release\amd64\CisUtMonitor.pdb

Imports

ntoskrnl.exe

ExDeletePagedLookasideList
IoUnregisterShutdownNotification
ExEventObjectType
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
PsGetVersion
ExInterlockedRemoveHeadList
CmRegisterCallback
IoCreateSymbolicLink
ExInitializePagedLookasideList
ObfDereferenceObject
IoCreateDevice
CmUnRegisterCallback
DbgPrint
ExDeleteNPagedLookasideList
IoThreadToProcess
KeSetEvent
ExpInterlockedPopEntrySList
ExInterlockedInsertTailList
PsGetProcessId
KeReleaseMutex
ExAllocatePoolWithTag
_wcsnicmp
RtlCheckRegistryKey
ZwQueryValueKey
RtlCompareUnicodeString
RtlConvertSidToUnicodeString
ZwOpenThreadTokenEx
RtlTimeToSecondsSince1970
MmGetSystemRoutineAddress
ZwOpenProcessTokenEx
ObQueryNameString
ExSystemTimeToLocalTime
ZwClose
ZwOpenProcess
RtlCopyUnicodeString
MmIsAddressValid
ZwQueryInformationToken
ZwOpenKey
KeBugCheckEx
PsSetCreateProcessNotifyRoutine
ExpInterlockedPushEntrySList
IoDeleteDevice
RtlInitUnicodeString
ExInitializeNPagedLookasideList
KeInitializeMutex
IoRegisterShutdownNotification
ExFreePoolWithTag
_wcsicmp
IoDeleteSymbolicLink
__C_specific_handler

fltmgr.sys

FltReleaseFileNameInformation
FltCloseCommunicationPort
FltGetFileNameInformation
FltGetDestinationFileNameInformation
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltParseFileNameInformation

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/UninstallTool.cpl
.dll windows:5 windows x64 arch:x64

9c93178cd8afc64354965ebaf62e32da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d
Signer

Actual PE Digest

9e:70:30:59:40:29:b8:86:5c:a3:67:f9:04:1d:2b:07:55:27:75:3f:6f:ed:85:01:2f:5e:60:cd:61:ef:32:0d

Digest Algorithm

sha256

PE Digest Matches

true

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2
Signer

Actual PE Digest

c5:90:1b:4d:1b:1f:16:e6:a4:6f:2c:e8:06:84:3a:a6:f7:25:cb:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
CloseHandle
lstrcpyW
lstrcatW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetVersionExW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
CreateFileW

user32

LoadIconW
LoadStringW

shell32

ShellExecuteW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW

Exports

Exports

CPlApplet

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/utshellext.dll
.dll regsvr32 windows:5 windows x64 arch:x64

99a462a3c8c3959a8c3fd90e70a36a53

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4
Signer

Actual PE Digest

d6:27:a9:00:77:6a:52:b0:ea:23:df:bb:d0:a8:e2:d1:85:dd:f8:3a:c6:19:f6:66:28:21:e1:3b:cb:1b:ff:b4

Digest Algorithm

sha256

PE Digest Matches

true

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45
Signer

Actual PE Digest

ec:98:c1:f5:9c:22:1b:9d:9e:2b:bd:37:5c:00:20:e8:de:c2:58:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x64\utshellext.pdb

Imports

kernel32

GetProcessHeap
FreeLibrary
ExpandEnvironmentStringsW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineA
GetCurrentThreadId
ReadFile
HeapReAlloc
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LoadLibraryExW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetModuleHandleA
FormatMessageA
HeapAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
LoadLibraryW
lstrlenW
LocalFree
GetProcAddress
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetModuleHandleW
GetLastError

user32

DrawIconEx
LoadImageW
GetParent
InsertMenuItemW
InsertMenuW
DestroyIcon
CreateIconIndirect
GetSystemMetrics
GetDC
ReleaseDC
MessageBoxW
GetActiveWindow
SetRect
GetIconInfo
GetMenuItemCount

gdi32

CreateDIBSection
SelectObject
GetDIBits
DeleteObject
CreateCompatibleDC
RealizePalette
GetObjectW
GetDeviceCaps
DeleteDC

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

shell32

SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW

ole32

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/CisUtMonitor.inf
x86/UninstallToolExec.exe
.exe windows:5 windows x86 arch:x86

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23-01-2017 20:43

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

Actual PE Digest

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18

Digest Algorithm

sha256

PE Digest Matches

true

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

Actual PE Digest

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Projects\uninstall-tool\Ready\UninstallToolExec.pdb

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW

kernel32

GetLastError
CloseHandle
CreateProcessW
LocalFree
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetProcAddress
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
FormatMessageW
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
CreateFileW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetModuleHandleA
IsDebuggerPresent

user32

GetSystemMetrics
ShowWindow
CreateWindowExW
GetActiveWindow
SetLayeredWindowAttributes
DefWindowProcW
RegisterClassExW
MessageBoxW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
FreeSid
RegQueryValueExW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 996KB

.rsrc Size: 44KB - Virtual size: 43KB

.reloc Size: 4KB - Virtual size: 3KB

c0b48261bcb0145356e497ab28881b46

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1bCertificate

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68Certificate

Extended Key Usages

Key Usages

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28Certificate

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68Certificate

Extended Key Usages

Key Usages

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18Signer

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

shell32

ole32

advapi32

oleaut32

Sections

.text Size: 79KB - Virtual size: 78KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 87KB - Virtual size: 86KB

.reloc Size: 6KB - Virtual size: 5KB

d290bdfeb2cc5f9b421f3b7c8b0446de

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 996KB

.rsrc
Size: 44KB - Virtual size: 43KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1f:be:44:76:41:e5:dd:3e:d2:17:14:3e:af:ff:ed:0e:f4:0e:33:6c:39:cd:08:d5:b4:23:60:a6:dd:4d:70:18
Signer

52:d8:51:86:b2:1f:e9:ba:7b:5f:60:95:82:9b:9d:2e:e5:64:e5:f3
Signer

.text
Size: 79KB - Virtual size: 78KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 87KB - Virtual size: 86KB

.reloc
Size: 6KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

50:c7:a8:bb:13:de:14:b4:88:fe:7c:fc:ee:2f:c2:68
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

e4:c7:e4:ed:3c:ec:35:ac:51:c9:ad:a1:58:2e:29:19:84:0d:0c:d3:03:3a:b0:02:0f:08:63:36:3c:07:19:5a
Signer

d2:25:b5:c6:c1:e0:a9:01:4d:55:cf:46:08:b0:c6:cb:78:a3:f9:08
Signer

.text
Size: 78KB - Virtual size: 80KB

10a9sz8k
Size: 31KB - Virtual size: 32KB

.data
Size: 6KB - Virtual size: 16KB

.rsrc
Size: 2KB - Virtual size: 4KB

k4x0ku6i
Size: 285KB - Virtual size: 288KB

92n.vcof
Size: 512B - Virtual size: 4KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 65KB - Virtual size: 104KB